Chevron Richmond Refinery Site-Safety-Plan

RICHMOND REFINERY
SITE SAFETY PLAN
Submitted to:
City of Richmond
Contra Costa County Health Services
February 2013
Submitted by:
Chevron U.S.A. Inc.
841 Chevron Way
Richmond, CA 94802-0627
CUSA 2013
SITE SAFETY PLAN

CUSA RICHMOND REFINERY
LAST REVISION: 6:22:35 AM
TABLE OF CONTENTS
1. Introduction
2. The Refinery
2.1.
Determination of Covered Processes within the Refinery
2.2.
Characteristics and Hazards Associated with the Regulated Substances
2.3.
Description of Processes Within the Refinery
2.4.
Definitions
3. Risk Management Program Elements
3.1.
Introduction
3.2.
Safety Program Management
3.3.
Process Safety Information
3.4.
Operating Procedures
3.5.
Employee Participation
3.6.
Training
3.7.
Mechanical Integrity
3.8.
Management of Change
3.9.
Pre Start-up Safety Review
3.10. Compliance Audits
3.11. Incident Investigation
3.12. Process Hazards Analysis & Action Items
3.13. Hot Work Permits
3.14. Contractors
3.15. Emergency Response Program
4. Human Factors Program
4.1.
4.2.
Human Factors Training
4.3.
Latent Conditions
4.4.
Process Hazards Analysis
4.5.
Root Cause Analysis
4.6.
4.7.
Management of Organizational Change
5. Accident History
6. Certification
7. Appendices
CUSA 2013
February 2013
SITE SAFETY PLAN

LAST REVISION: 8/14/2003 6:22:35 AM

1.0
Introduction
This Site Safety Plan (SSP) was prepared in accordance with the City of Richmond
Industrial Safety Ordinance 42-03 (RISO) approved on January 17, 2002, by the
Richmond City Council. The primary intent of this ordinance is to prevent and reduce
the probability of accidental releases of regulated substances that have the potential to
cause significant harm to the public health and increase the participation by industry and
the public to improve accident prevention. This SSP has been updated from the previous
version prepared in 2009 to reflect changes made to the Chevron U.S.A. Inc. (CUSA)
Refinery in Richmond, California (Refinery) since that time, including changes resulting
from the Contra Costa Hazardous Materials Program (CCHMP) audit in 2011, and to
meet the RISO legal requirement to update the SSP once every three years.
The CUSA Richmond Refinery
The Refinery is owned and operated by CUSA and is located in the City of Richmond,
Contra Costa County, California. The Refinery is the largest refinery in the Bay Area,
with an approximate capacity of 245,000 barrels of crude oil per day. The Refinery
covers approximately 2,900 acres. There are approximately 1,200 employees at the
Refinery, routinely augmented by contractors.
The Refinery is located on a peninsula bordered by the San Francisco Bay to the north
and west, the San Pablo Bay to the northeast, the General Chemical Company to the east
and the City of Richmond to the east and south. Point Molate and the Quarry Products
Company are situated nearby on the western edge of the peninsula, the Parr-Richmond
Terminal Corporation is located on the northwestern tip, and the Point San Pablo Yacht
Harbor occupies a small section of the northern edge of the peninsula. The area
immediately surrounding the Refinery is nearly all industrial except for the
neighborhoods of Point Richmond to the south, Atchison Village to the southeast, North
Richmond to the northeast, and the Iron Triangle to the east.
The Refinerys primary business is to make transportation fuels from crude oil. The
transportation fuel products produced at the Refinery include gasoline, jet fuel, and diesel
fuel. The Refinery also produces lubricating oils and liquefied petroleum gas (LPG).
Several byproducts are produced by the Refinerys production processes, including sulfur
and anhydrous ammonia, which are recovered from sulfur and nitrogen contained in the
crude oil. Substances present at the refinery that are regulated by the U.S. Environmental
Protection Agencys (EPA) Risk Management Plan (RMP) regulations and the California
Accidental Release Prevention (Cal/ARP) regulations include flammable hydrocarbons,
hydrogen sulfide (H2S), ammonia (NH3), and sulfuric acid (H2SO4) mixed with
flammable hydrocarbons.
CUSA Operational Excellence
CUSA has built a culture of safety and environmental stewardship that strives to achieve
world-class performance and prevent all incidents. Our workforce believes that incidents
are preventable, and we have policies, processes, tools and behavioral expectations in
CUSA 2013
1-1
February 2013
SITE SAFETY PLAN

LAST REVISION: 8/14/2003 6:22:35 AM

place to assist us in achieving that goal. We call this Operational Excellence (OE), and it
drives everything we do.
CUSAs OE vision is to be regarded by industry and the communities in which we
operate as world-class in process safety, personal safety, health, protection of the
environment, reliability and efficiency.
CUSAs OE safety culture is based on 10 Tenets of Operation, a code of conduct that
employees and contractors use and that supervisors and managers reinforce. These Tenets
are based on two key principles:
Do it safely or not at all; and

There is always time to do it right.
Another key aspect of CUSAs safety culture is stop-work authority. Every member of
CUSAs workforce whether employee or contractor has the authority and
responsibility to stop work any time they see a condition that may present a risk to people
or to the environment.
The corporate values embodied in CUSAs safety culture are the foundation of the
Refinerys Safety Program, a comprehensive description of which is provided in Section
3.2, Safety Program Management.
CUSA 2013
1-2
February 2013
SITE SAFETY PLAN

10:06:48 AM
2.0
The Refinery
2.1
Determination of Covered Processes within the Refinery

The Refinery is divided into different operating processes, as shown in Table 2-1.
Simplified process flow drawings for each of the covered processes listed appear in
Section 7, Appendices.
Information on the quantities and locations of substances handled in the Refinery is
included in the Refinerys Hazardous Materials Business Plan. The substances discussed
within this document are those covered under the RMP and Cal/ARP programs. The
RMP and Cal/ARP programs apply only to processes with more than a threshold quantity
of a regulated substance or processes that are interconnected or co-located with other
processes that contain more than a threshold quantity of a regulated substance.
To identify the processes that are covered by the RMP and Cal/ARP regulations, the
Refinery determined the maximum quantity of regulated substances in each process. The
Refinery made this determination by reviewing process flow diagrams (PFDs),
calculating the quantity or regulated substances in each vessel, using a conservative
factor to estimate the quantity of regulated substances contained in pipelines, and then
summing these quantities for each process. The maximum quantity in each process was
then compared to RMP and Cal/ARP threshold levels. Each process that exceeded a
threshold quantity of a regulated substance is considered a RMP and/or Cal/ARP covered
process. A listing of these processes is shown in Table 2-1. Each covered process is
described in the following subsections, organized by area business unit. The RISO
requires all covered processes not included in the RMP Level 3 management program to
be subjected to the Process Safety Management (PSM) elements described in Section 3,
Risk Management Program Elements.
CUSA 2013
2-1
February 2013
SITE SAFETY PLAN

10:06:48 AM
Table 2-1 Summary of Covered Processes
Maximum Quantity in Process (pounds)
Federal
& State
Cal/ARP
Program
Level
RISO
#4 Crude Unit
Yes
#5 NHT
Yes
#5 Rheniformer
Yes
LSFO K-900s
Covered Process
#4 Rheniformer
State
Only
No
Regulated
Substances **
Total
Flammable
Mixture
NH3 *^
H2S
H2SO4
Flammables, NH3
400,000
2,500
Flammables
100,000
2,500
Colocated w #5 NHT
Yes
Colocated w #5 NHT
No
N/A
N/A
Penhex-Isom
Yes
Flammables
560,000
DHT
Yes
Flammables
33,000
5 H2S
Yes
Flammables, H2S, NH3
160,000
200,000
790
FCC
Yes
Flammables
1,200,000
7,800,000
5,800,000
Alky
Yes
Flammables, H2SO4
Butamer
Yes
Flammables
150,000
Yard DIB
Yes
Flammables
290,000
LPG Storage
Yes
Flammables
39,000,000
Alky/GRU
Yes
Flammables
210,000
SHU
Yes
Flammables
43,000
Railcar Storage
Yes
Flammables, NH3
52,000,000
1,600,000
Poly
Yes
Flammables
430,000
3 H2S/SWC
Yes
Flammables
49,000
H2S
2,900
SRU
Yes
NH3 Storage
Yes
NH3
680,000
TKC
Yes
Flammables, H2S
32,000
8,300
TKN/ISO
Yes
Flammables, H2S
210,000
4,900
SDA
Yes
Flammables
1,200,000
#8 Plant
Yes
34,000
29,000
1,100
LNC
Yes
Flammables
14,000
HNC
Yes
24,000
830
810
LNF
Yes
Flammables
31,000
GRU
Yes
Flammables, H2S
280,000
800
#18 Plant
Yes
150,000
27,000
750
Cogen
Yes
Flammables, NH3
12,000
800
T&B Crude
Yes
Flammables
1,100,000
T&B Refined
No
No
N/A
N/A
Long Wharf
No
No
N/A
N/A
1 H2SO4 is regulated by Cal/ARP because it is mixed with flammable hydrocarbons.
CUSA 2013
2-2
February 2013
SITE SAFETY PLAN

10:06:48 AM
Covered Process
State
Only
JHT
GHT
Maximum Quantity in Process (pounds)
Federal
& State
Cal/ARP
Program
Level
RISO
Yes
Yes
Regulated
Substances **
Flammable
Mixture
Flammables
210,000
Total
NH3 *^
Flammables
11,000
H2 Manufacturing
Yes
Flammables, NH3
9,700
1,200
Hydro Flares
Yes
Flammables, NH3
8,900
1,300
H2S
H2SO4
H2 Recovery
No
No
N/A
N/A
H2 Boosters
No
No
N/A
N/A
4H2S
No
No
N/A
N/A
HNF
Yes
Flammables
35,000
Gas Distribution
Yes
Flammables
54,000
No
N/A
N/A
Effluent Treating
#1 Power Plant
2.2
No
No
No
N/A
X
N/A
Flammables
=
regulated flammable hydrocarbon mixture (NFPA4)
=
hydrogen sulfide
H2S
=
sulfuric acid
H2SO4
=
ammonia
NH3
=
substance is not contained in process or is not held above threshold quantities
X
=
RISO covered process
* Federal threshold for anhydrous NH3 is 10,000 lbs; threshold for aqueous NH3 >20% is 20,000 lbs
^ State threshold for NH3 >1% is 500 lbs
** Regulated Substances in this table includes those substances held in quantities above the threshold level listed in either the RMP
regulations or the Cal/ARP regulations. Please refer to the Refinerys Hazardous Materials Business Plan for names and quantities of
substances held in quantities below these threshold levels, or for those substances covered only by RISO.
Characteristics and Hazards Associated with the Regulated Substances

This section of the report describes the characteristics and hazards of the substances
regulated under the RMP and Cal/ARP programs.
2.2.1
Characteristics and Hazards of Anhydrous Ammonia

Anhydrous Ammonia (NH3) is the third highest-volume chemical produced in the
United States. Nitrogen (N) is an impurity contained in most crude oils that must
be removed. Nitrogen removal is accomplished by the catalytic reaction of
nitrogen with hydrogen (H) to form NH3. The NH3 is then sold for fertilizer
production. At atmospheric temperatures and pressure, NH3 is a colorless gas with
a sharp, intensely irritating odor. NH3 is very soluble in water, which makes water
useful in reducing NH3 releases. Properties of NH3 are shown in Table 2-2.
Depending on the concentration and duration of the exposure, the health effects of
low concentrations of NH3 gas (below the ERPG-3 concentration) include mild to
severe irritation of the lining of the nose, eyes, throat, and lungs. Inhalation of
high concentrations (above the ERPG-3 concentration) may injure the lungs with
possible fatal consequences. Due to its low odor threshold, NH3 has good warning
properties because it can be smelled at a level more than 200 times lower than the
ERPG-3 concentration.
CUSA 2013
2-3
February 2013
SITE SAFETY PLAN

10:06:48 AM
Table 2-2 Properties of Anhydrous Ammonia
Property
Value
Comments
Odor Threshold
5.2 ppm
None.
ERPG-1
25 ppm
The concentration that nearly all individuals could be exposed to for one
hour without experiencing other than mild transient health effects or
perceiving a clearly defined objectionable odor.
ERPG-2
200 ppm
The concentration below which it is believed that nearly all individuals

could be exposed to for one hour without experiencing or developing
irreversible or other serious health effects or symptoms which could
impair an individuals ability to take protective action.
ERPG-3
1,000 ppm

life-threatening effects.
Vapor specific
gravity
0.6
NH3 vapor is lighter than air. When pressurized liquid NH3 is released, it
initially forms a denser-than-air, cold cloud of NH3 mist. From the
release point, a pool of NH3 liquid will form beneath the container from
which additional NH3 will evaporate.
Expansion ratio
850:1
For a given volume of NH3 liquid, it will expand to 850 times when
released to air.
Boiling point
-28.4F
Ignition temperature
1,204F
ERPG
ppm
None.
NH3 is difficult to ignite and is not flammable under normally

encountered conditions.
Emergency Response Planning Guideline
Parts Per Million
=
=
Chemical-Specific Prevention Steps for Anhydrous Ammonia

The Refinerys NH3 storage area has been designed to minimize the risk of
releasing anhydrous ammonia. Safeguards were installed when the NH3 storage
was relocated in 1991 from a storage area near Castro Street to the current site.
Some of the specific prevention and mitigation safeguards are described below:
CUSA 2013
Each storage vessel is equipped with a firewater deluge system to reduce

the vapor cloud and cool the vessel in the event of a fire.
The NH3 storage area is equipped with a NH3 leak detection system that
activates alarms in the field and in the control room to alert the plant
operator if a leak develops.
The NH3 storage area is equipped with alarms, pressure relief devices,
excess flow valves, and emergency block valves to prevent or limit the
severity of a release.
The NH3 storage area is encircled by a firewater-monitor fog system. One

large water fog spray can be remotely operated.
2-4
February 2013
SITE SAFETY PLAN

10:06:48 AM
2.2.2
The drainage in the storage area is such that a release of liquid drains away
from the bullets and minimizes the surface area to reduce the amount of
evaporation.
Characteristics and Hazards of Hydrogen Sulfide

Hydrogen Sulfide (H2S) is handled in Refinery processes in quantities below the
RMP threshold, but above the Cal/ARP threshold. Sulfur is an impurity contained
in most crude oils that must be removed. Sulfur removal is accomplished by the
catalytic reaction of sulfur with hydrogen to form H2S. The sulfur is then
recovered from the H2S streams in the Sulfur Recovery Unit (SRU) and sold as
commercial sulfur. H2S is a colorless gas with a rotten egg odor. H2S is very
soluble in water, which makes water useful in reducing H2S releases. Properties of
H2S are shown in Table 2-3.
H2S is extremely poisonous, and breathing any concentration must be avoided.
H2S is both an irritant and asphyxiant. Concentrations from 20 to 150 ppm cause
irritation of the eyes; slightly higher concentrations may cause irritation of the
upper respiratory tract. With higher concentrations, the action of the gas on the
nervous system becomes more prominent. Exposure to higher concentrations of
H2S paralyzes the smelling senses and, as a result, can give a false sense of
security. Exposures of 800 to 1,000 ppm may be fatal in 30 minutes and higher
concentrations are instantly fatal.
CUSA 2013
2-5
February 2013
SITE SAFETY PLAN

10:06:48 AM
Table 2-3 Properties of Hydrogen Sulfide
Property
Value
Comments
Odor Threshold
0.003 to
0.02 ppm
The odor of H2S is distinct at 0.003 ppm, but at concentrations above 100
ppm olfactory fatigue occurs and no odor is detected.
ERPG-1
0.1 ppm
The concentration that nearly all individuals could be exposed to for one
hour without experiencing other than mild transient health effects or
perceiving a clearly defined objectionable odor.
ERPG-2
30 ppm

irreversible or other serious health effects or symptoms which could
impair an individuals ability to take protective action.
ERPG-3
100 ppm

life-threatening effects.
1.18
H2S vapors are heavier than air and would act as a dense gas. H2S mixed
with other gases or at higher temperatures may behave as a neutrally
buoyant gas.
Vapor specific gravity
Boiling point
-59.6F
None.
Ignition temperature
500F
None.
ERPG
ppm
=
=
Emergency Response Planning Guideline

Parts Per Million
Chemical-Specific Prevention Steps for Hydrogen Sulfide

The processes containing H2S are equipped with safety systems designed to
prevent or minimize releases of H2S. The majority of these safeguards were
installed when each unit was constructed, beginning in the late 1960s and up to
the Cleaner Fuels Project in 1995. The safety systems in place are described
below:
CUSA 2013
Each SRU train is equipped with either a safety shutdown system or a

shutdown interlock system designed to protect personnel and equipment
and prevent the potential release of H2S. Each of these systems shuts down
key pieces of equipment automatically when certain operating parameters
are outside of safe operating limits.
The SRU is equipped with an emergency quench water system, which can
be operated automatically, to protect equipment in the event of a fire.
Each process that contains H2S is equipped with alarms, pressure relief
devices, and emergency block valves to prevent or limit the severity of a
release.
Each H2S Recovery Plant can be routed to an emergency scrubber in the

event of a SRU shutdown.
2-6
February 2013
SITE SAFETY PLAN

10:06:48 AM
2.2.3
Each process that contains significant quantities of H2S is equipped with

an H2S area monitoring system that will detect ambient levels of H2S and
activate alarm systems. The alarm systems will indicate the location and
concentration of H2S leaks.
The Refinery has H2S monitors located along the Refinerys perimeter to
alert Refinery personnel if H2S is detected.
Characteristics and Hazards of Regulated Flammable Hydrocarbons

The Refinery handles many flammable hydrocarbons regulated by RMP
regulations. Flammable hydrocarbons are produced by separating the light ends
from crude oil in the production of gasoline and other fuels. The flammable
hydrocarbons in the Refinery include pure substances, such as propane, butane,
and pentane, and mixtures of hydrocarbons that are mainly pentane or lighter.
Hydrogen is also produced and used within the refinery for hydrotreating and
hydrocracking processes. Flammable hydrocarbons pose extreme fire hazards.
The liquid will quickly evaporate, even at low temperatures, and form a vapor
(fumes) which can ignite and burn with explosive violence. Water sprays have
some effect in breaking up a small hydrocarbon vapor cloud. Properties of
common flammable hydrocarbons are shown in Table 2-4.
Flammable hydrocarbons and hydrogen are considered nontoxic; their hazards are
extreme flammability and explosiveness. Although propane (C3) at high
concentrations can cause central nervous system depression, it usually causes
asphyxiation by displacement of air. At an atmospheric concentration of 10
percent (100,000 ppm), propane is not noticeably irritating to the eyes, nose or
respiratory tract, but will produce dizziness in a few minutes. Recovery is usually
complete with no after effects. Butane (C4) is also an asphyxiant, and can cause
central nervous system damage at very high concentrations. Butane levels of 1
percent (10,000 ppm) in air have caused drowsiness, but no other evidence of
systemic effects. Because the liquid product evaporates quickly, it can have a
severe chilling effect on skin or eyes and can cause local freezing of tissues
(frostbite).
CUSA 2013
2-7
February 2013
SITE SAFETY PLAN

10:06:48 AM
Table 2-4 Properties of Flammable Hydrocarbons
Property
Propane (C3)
Butane (C4)
LPG
Boiling point
-44F
-31F
-44 to +97F
Vapor density
1.6
2.0
1.9
2.1 9.5%
1.9 8.5%
2 10%
Autoignition temperature
--
--
842F
TLV (8-hr exposure)
--
800 ppm
1,000 ppm
Flammability limits
Ppm
TLV
=
=
Parts Per Million

Threshold Limit Value
Chemical-Specific Prevention Steps for Flammable Hydrocarbons

The Liquefied Petroleum Gas (LPG) storage area has been designed to minimize
the risk of releasing flammable hydrocarbons to the atmosphere by providing high
equipment reliability, minimizing the number of connections, avoiding
unnecessary equipment, and protecting against inadvertent damage or failure.
Some of the specific prevention and mitigation safeguards are described below:
2.2.4
CUSA 2013
The LPG storage spheres are located away from the refinery perimeter to
minimize the effect on the public in the event of a release.
A distance sufficient to limit a fire to a single sphere separates each

sphere.
Each sphere is equipped with a firewater deluge system to cool the vessel
to prevent failure in the event of a fire.
The LPG storage area is equipped with alarms, pressure relief devices, and
emergency block valves to prevent or limit the severity of a release.
Each sphere is equipped with a fusible link valve, which is a check valve
that will automatically close during a fire and isolate the sphere from all
other systems.
The surrounding area is equipped with a fire suppression system, which

consists of fixed fire monitors.
The drainage near the spheres would cause released liquid to drain away
from the spheres and the rest of the refinery and would minimize the
surface area to reduce the amount of evaporation.
Characteristics and Hazards of Sulfuric Acid

Sulfuric acid (H2SO4) is used as a catalyst in the alkylation process to convert
olefins and isobutanes into alkylate products. Fresh sulfuric acid is delivered via
2-8
February 2013
SITE SAFETY PLAN

10:06:48 AM
pipeline from the General Chemical facility adjacent to the refinery. Spent
sulfuric acid is returned via pipeline to General Chemical for regeneration.
Properties of sulfuric acid are shown in Table 2-5.
H2SO4is very hazardous in case of skin contact, eye contact, ingestion or
inhalation. Liquid or spray mist may produce tissue damage particularly on eyes,
mouth and respiratory tract. Skin contact may produce burns. Inhalation of the
spray mist may produce severe irritation of respiratory tract. Severe overexposure can result in death.
Table 2-5 Properties of H2SO4
Property
ERPG-1
Value
2 mg/m3
ERPG-2
10 mg/m3
ERPG-3
120
mg/m3
Liquid specific
gravity
Boiling point
ERPG
mg/m3
1.84
590F
Comments
The concentration that nearly all individuals could be
exposed to for one hour without experiencing other than
mild transient health effects or perceiving a clearly
defined objectionable odor.
The concentration below which it is believed that nearly
all individuals could be exposed to for one hour without
experiencing or developing irreversible or other serious
health effects or symptoms which could impair an
individuals ability to take protective action.
The concentration below which it is believed that nearly
all individuals could be exposed to for one hour without
experiencing or developing life-threatening effects.
None.
Can yield toxic sulfur trioxide gas at temperatures greater
than 572F.
= Emergency Response Planning Guideline

= Milligrams Per Cubic Meter
Chemical-Specific Prevention Steps for H2SO4

The process equipment containing H2SO4 is equipped with safety systems
designed to prevent or minimize releases of H2SO4. The safety systems in place
are described below:
CUSA 2013
Process equipment that contains H2SO4 is equipped with alarms,

indicators, pressure relief devices, and emergency block valves to prevent
or identify and limit the severity of a release of H2SO4.
In case of emergency shutdown, H2SO4 containing process gasses are

routed to a scrubber system to remove H2SO4 prior to being routed to the
relief system.
2-9
February 2013
SITE SAFETY PLAN

10:06:48 AM
2.3
H2SO4 storage is equipped with containment berms so that potential

releases can be contained, analyzed, and treated accordingly. Berms are
surveyed routinely to detect any potential loss of containment.
Process sewers are equipped with pH analyzers to detect possible loss of

containment of H2SO4. Contaminated water can be isolated, contained and
treated accordingly.
Description of Processes within the Refinery

Described below are descriptions of each of the processing units within the Refinery.
These units are divided into four major areas or Refinery Business Units (RBUs).
2.3.1 Blending, Shipping, Utilities and Environmental Refinery Business Unit
There are three covered processes in this business unit: the light poly tank in the
Transfer & Blending (T&B) section, and the Cogeneration process (Cogen) and
Gas Distribution system in the Utilities & Environmental (U&E) section.
Transfer & Blending
Transfer & Blending is used for storage of materials either for sale or for use in
other Refinery units. Light Poly is stored in tank T-1843 and is only used for the
startup of the Poly Plant. T-1843 is filled with light polymer from the Poly Plant
C-660 overhead stream. The Light Poly in T-1843 is not sold. During normal
operation, the light poly from C-660 overhead is refluxed back to the column or
sent to the Jet Hydrotreater (JHT). It can also be routed into the Fluid Catalytic
Cracker (FCC) light gasoline or heavy gasoline streams.
The RMP-regulated substances in Transfer & Blending are flammable
hydrocarbons.
Cogen
Cogen is a dual train plant designed to generate electricity and steam at rates
which, along with Power Plant production, supply most of the Refinery's internal
power and some of the Refinerys thermal energy requirements. The Cogen
process is made up of the combustion gas turbines (CGT), which use fuel to
generate electricity, and the heat recovery steam generators (HRSG), which use
the hot CGT exhaust gas to produce steam for distribution to the refinery. Fuels
supplied to Cogen include natural gas, liquefied petroleum gas, and refinery fuel
gas, which is used solely to fire the HRSG auxiliary duct burners. NH3 is injected
into the HRSG to control NOx formation.
The RMP-regulated substances in the Cogen process are flammable hydrocarbons
and NH3.
CUSA 2013
2-10
February 2013
SITE SAFETY PLAN

10:06:48 AM
Gas Distribution
Gas Distribution is responsible for routing fuel to users throughout the refinery
and consists of four main systems: Fuel Gas, Process Gas, Natural Gas, and
Medium BTU (MBTU) Gas.
Fuel gas is supplied from fuel gas mix drums to various fuel users throughout the
refinery to use as combustion material. Process gas is off gas from various process
units in the refinery. It may be routed directly into a fuel gas mix drum or sent
through a H2S removal plant before being mixed into the fuel gas. Natural gas
supplements the refinery fuel gas system and H2 manufacturing and Cogen feed
stock, and is supplied by PG&E. MBTU gas is used as replacement for the natural
gas provided by PG&E, and as an alternative feed stock for Cogen.
The RMP-regulated substances in the Gas Distribution process are flammable
hydrocarbons.
2.3.2
Cracking Refinery Business Unit

The Cracking RBU is split into three sections, the Fluid Catalytic Cracking
section, the LPG section and the Sulfur Recovery section. The RMP covered
processes in the FCC section include the FCC and the #3 H2S Recovery
Plant/Sour Water Concentrator (SWC). The RMP covered processes in the LPG
section include Alkylation (Alky), Alky Gas Recovery Unit (GRU), Selective
Hydrogenation Unit (SHU), Butamer, Yard Deisobutanizer (DIB), Polymer
(Poly), LPG Storage, NH3 Storage, and Railcar Storage. The RMP-covered
process in the Sulfur Recovery section is the SRU and its associated SWC.
Fluid Catalytic Cracking Section
Fluid Catalytic Cracker
The FCC process converts heavy hydrocarbon gas oil into lighter
hydrocarbons (gasoline, LPG, and feed for the Poly and Alky processes) using
a specialized catalyst. The feed to the FCC normally consists of heavy gas oil,
waxy lube oils, purchased low-sulfur FCC feeds, and off test or excess
Richmond Lube Oil Plant (RLOP) lube oils. Hot, regenerated catalyst from
the regenerator is transferred to the lift zone of the reactor riser. Here, steam
and sour process gas lift the catalyst to the feed zone. At the feed zone, total
feed is sprayed into the catalyst by feed nozzles. The feed immediately
vaporizes and then cracks as it travels up the riser. The feed deposits coke on
the catalyst while it cracks. At the end of the riser, the spent, coked catalyst
and product (reaction mix) are separated by the reactor cyclones. The catalyst
is directed to the stripping section, where steam removes displaceable
hydrocarbons from the spent catalyst. The reaction mix proceeds to the main
fractionator for condensing and product separation.
CUSA 2013
2-11
February 2013
SITE SAFETY PLAN

10:06:48 AM
The FCC gas recovery section separates the fractionator overhead liquid and
vapor streams into the light-end products. This separation is accomplished by
the following series of distillation columns; deethanizer, depentanizer,
debutanizer, depropanizer, and a gasoline splitter.
The RMP-regulated substances in the FCC Plant are flammable hydrocarbons.
The majority of flammable hydrocarbons are contained in the gas recovery
section of the FCC.
#3 H2S Recovery/Sour Water Concentrator
The #3 H2S Plant is designed to purify the sour gas streams (those containing
H2S) generated in the Cracking area business unit. This is achieved by
absorbing H2S in aqueous diethanolamine (DEA) solution in the H2S
absorber. DEA rich in H2S is regenerated releasing the H2S in the reactivator.
Lean DEA is recirculated back to the H2S absorber. Once purified (or
sweetened), the gases are used as Refinery fuel gas. Recovered H2S gas is sent
to the SRU for conversion to sulfur.
The SWC uses steam to strip NH3 and H2S from sour water generated in the
FCC. The SWC consists of two main columns: the SWC column and the NH3
stripper. Each is dependent upon the other, and both are operated as one.
Stripped water is then routed to the effluent treatment system. Concentrate is
routed to the sour water tank for processing by the NH3-H2S recovery plants
(plants #8 and #18).
The RMP-regulated substances in this plant are flammable hydrocarbons.
LPG Section
Alkylation
The Alky process uses contactors and effluent refrigeration to cool the
contactors. In the process, olefins react with isobutane in the presence of a
sulfuric acid catalyst to form alkylate. The feed for the Alky Plant consists of
olefins and isobutane. These streams are blended, cooled, and freed of water
before going into the process. The alkylate product is a mixture of
hydrocarbons within the gasoline boiling range. Blending of this stream into
the Refinery gasoline pool increases the gasoline octane and reduces the olefin
content and vapor pressure of the gasoline. A portion of the alkylate feeds the
rerun column, which removes the heavier components. This provides a
rerun alkylate overhead product that is used in aviation gasoline.
The RMP-regulated substances in the Alky process are flammable
hydrocarbons and sulfuric acid mixed with flammable hydrocarbons.
Alky Gas Recovery Unit and Selective Hydrogenation Unit
The GRU saturates di-olefins to olefins in the SHU Plant and fractionates an
CUSA 2013
2-12
February 2013
SITE SAFETY PLAN

10:06:48 AM
alkylate stream into butane, mixed pentanes, and whole alkylate.
The RMP-regulated substances in the GRU and SHU process are flammable
hydrocarbons.
Butamer
The Butamer process converts normal butane into isobutane using a
specialized catalyst. The feed is a combination of the overhead streams from
two debutanizers, C-1020 and C-410. The butane feed is passed through a
drier to remove any moisture and sulfur, mixed with hydrogen, heated to
approximately 300F then passed over a platinum based catalyst. The
resulting mixture of unconverted feed and products are separated in a
stabilizer column. The isobutane product is used in the Alkylation process.
The RMP-regulated substances in the Butamer process are flammable
hydrocarbons.
Yard Deisobutanizer
The primary purpose of the Yard DIB is to recover isobutane for use in the
Alky process. The Yard DIB also produces pentane for gasoline blending,
recovers commercial grade butane, and separates process gas (ethane and
lighter) that is sent to the #3 H2S Recovery Plant.
The RMP-regulated substances in the Yard DIB process are flammable
hydrocarbons.
Liquefied Petroleum Gas Storage
The LPG storage area consists of 16 storage spheres, an LPG distribution
system, and loading racks. The LPG storage area buffers producers and
consumers of LPG by inventorying differences between production and
consumption rates in the LPG spheres. The unit imports and exports LPG
using both railcars and tank trucks. LPG is also routed within the unit to
various Refinery consumers.
The RMP-regulated substances in the LPG storage area are flammable
hydrocarbons.
Railcar Storage
The Railcar Storage area helps to maintain inventory differences of both LPG
and NH3 between production and consumption rates of the Refinery. The
Railcar Storage area includes all railcars of LPG and NH3 storage within the
control of the Refinery. The primary railcar storage areas are located in the
Santa Fe Rail Yard (across Castro Street), the Altamont Racks, and near the
lagoon at the Rod and Gun Club. All NH3 rail cars are stored within the
Refinery boundaries and in close proximity to the NH3 Storage area.
CUSA 2013
2-13
February 2013
SITE SAFETY PLAN

10:06:48 AM
The RMP-regulated substances

hydrocarbons and NH3.
in
Railcar
Storage
are
flammable
Polymer Process
The function of the Poly process is to convert propylene into topped polymer
using catalytic polymerization. The propylene feed stock comes from the C3
olefins produced by the FCC process. The polymerization reaction is carried
out using a bulk phosphoric acid process. The polymer is sold primarily as a
feed stock in the manufacture of lube oil additives and detergents.
The RMP-regulated substances in the Poly process are flammable
hydrocarbons.
Anhydrous Ammonia Storage
The NH3 storage area consists of three storage vessels, the NH3 off-plot
system, and loading racks. The NH3 storage area receives NH3 from the #8
and #18 Plants. The NH3 off-plot system consists of the overall NH3 piping
distribution system. NH3 is supplied to consumers throughout the Refinery,
including the FCC precipitator, low-NOx boilers in RLOP, Crude Unit
furnaces, the emergency scrubber in the #5 H2S Recovery Plant, the
Cogeneration facility and the railcar loading racks for exporting NH3 to other
consumers.
The RMP-regulated substance in the NH3 storage area is NH3.
Sulfur Recovery Section
Sulfur Recovery Unit
The SRU was designed to meet sulfur emission atmospheric standards by
converting H2S into elemental sulfur. H2S generated in several Refinery
processes is removed and sent to the SRU where it is converted to elemental
sulfur and sold at the Sulfur Loading Facility.
The SRU consists of the following sections: (1) the Bull Pen Area in which all
of the Refinerys H2S streams are brought together, (2) the Claus Unit where
all the H2S and sulfur dioxide (SO2) is converted to liquid sulfur, (3) the Tail
Gas Unit where the unreacted H2S is converted to SO2, (4) the SO2 Recovery
Plants where SO2 from rich sulfide solution is recovered and recycled back to
the Claus Unit, and (5) the Product Sulfur Area where the liquid sulfur is
stored and loaded in tank trucks and railcars for sale.
The SRU also has a SWC that operates in a similar manner to the SWC in the
#3 H2S Recovery Plant. This SWC receives dilute sour water from the
Distillation and Reforming area business unit.
CUSA 2013
2-14
February 2013
SITE SAFETY PLAN

10:06:48 AM
The RMP-regulated substance in the SRU is H2S.
2.3.3
Distillation and Reforming Refinery Business Unit

The Distillation and Reforming RBU is split into the East Side and the West Side.
RMP covered processes on the East Side include the #4 Crude Unit, Diesel
Hydrotreater (DHT), Gasoline Hydrotreater (GHT) and #5 H2S Recovery Plant.
RMP covered processes on the West Side include the JHT, #5 Naphtha
Hydrotreater (NHT) with #5 Rheniformer and LSFO K-900 Plant, #4
Rheniformer, and the Penhex-Isomerization (Penhex-Isom) process.
East Side
#4 Crude Unit
All crude oil that enters the Refinery is first processed through the #4 Crude
Unit. The purpose of the #4 Crude Unit is to produce feeds for the
downstream processing units. The #4 Crude Unit uses a distillation process to
separate the different side cuts. Raw crude oil is first heated and then fed to
the atmospheric column. The bottoms from the atmospheric column are sent
to the vacuum column for further separation. The overhead from the
atmospheric column is fed to the stabilizer, which separates light ends from
the naphtha stream.
The RMP-regulated substances in the #4 Crude Unit are flammable
hydrocarbons. The majority of the flammable hydrocarbons are taken off the
top of the atmospheric column and processed through the stabilizer.
Diesel Hydrotreater
The purpose of the DHT is to upgrade diesel fuel so that it meets ultra-low
sulfur fuel specifications. The primary function of the DHT unit is to
hydrotreat diesel from the #4 Crude Unit by removing sulfur and nitrogen.
The reactor also saturates olefins and aromatics, which reduces the aromatic
content of the diesel.
The mixture then enters the separation section where the excess hydrogen is
separated and recycled back to the reactor. The desulfurized hydrocarbon and
H2S go on to the distillation section where the H2S and light ends are removed
from the final diesel product. After the process is complete, the diesel is put
through a salt drier where moisture is removed before going to storage for
sale.
The RMP-regulated substances in the DHT are flammable hydrocarbons.
Gasoline Hydrotreater
The GHT is a two step process for removing sulfur from FCC Naphtha
streams. The first reactor is a Selective Hydrogenation Unit that hydrogenates
CUSA 2013
2-15
February 2013
SITE SAFETY PLAN

10:06:48 AM
dioelfins to olefins. The second reactor is where the desulfurization reactions
occur.
The mixture then enters the separation section where the excess hydrogen is
separated and recycled back to the reactors. The desulfurized hydrocarbon and
H2S go on to the distillation section where the H2S and light ends are removed
from the final naphtha product. After the process is complete, the treated
gasoline is stored as a gasoline blend component.
The RMP-regulated substances in the GHT are flammable hydrocarbons.
#5 H2S Recovery Plant
The #5 H2S Recovery Plant is designed to purify the sour gas streams (those
containing H2S) generated in the Distillation and Reforming area business
unit. Once purified (or sweetened), the gases are used as Refinery fuel.
Recovered H2S gas is sent to the SRU for conversion to sulfur. Sour gas
purification is achieved by absorbing H2S in an aqueous DEA solution in the
H2S absorber. DEA rich in H2S is regenerated and the H2S is routed to the
SRU. Lean DEA (without H2S) is recirculated back to the H2S absorber.
The Refinery has an emergency scrubber that is used for events such as loss of
the SRU. When the SRU is shut down, the H2S streams are routed to the
emergency scrubber by the process control operator. Aqua ammonia stored in
a tank is circulated to the emergency scrubber for H2S absorption. The
H2S/NH3 stream from the emergency scrubber is sent to the sour water tank
for processing by #8 and #18 Plants.
The RMP-regulated substances in #5 H2S Plant are H2S, NH3, and flammable
hydrocarbons.
West Side
Jet Hydrotreater
The primary purpose of the JHT is to remove sulfur and nitrogen from the Jet
draw from the atmospheric column of the #4 Crude Unit. The JHT then
separates it into a naphtha stream that goes to #5NHT, and into jet which goes
directly to finished jet products.
The RMP-regulated substances in the JHT are flammable hydrocarbons.
#5 Naphtha Hydrotreater Plant
The primary purpose of the #5 NHT is to desulfurize and denitrify naphtha
from the bottom of the stabilizer in the #4 Crude Unit. The #5 NHT then
separates it into light and heavy naphtha, which are fed to the Penhex unit and
the Naphtha Splitter, respectively.
CUSA 2013
2-16
February 2013
SITE SAFETY PLAN

10:06:48 AM
This RMP-covered process also contains the #5 Rheniformer Plant and the
LSFO K-900 Plant based on co-location of equipment.
#5 Rheniformer Plant
This Plant upgrades gasoline to higher-octane gasoline. The process
consists of passing a mixture of vaporized hydrocarbons and hydrogen
over a catalyst at a controlled temperature and pressure. Naphtha from the
NHT/Naphtha Splitter is fed to the plant where it contacts a platinumrhenium
catalyst.
Here,
dehydrogenation,
dehydrocyclization,
hydrocracking and isomerization take place. These reactions result in the
conversion of saturated feed components into aromatic hydrocarbons,
which are high-octane gasoline components.
LSFO K-900 Plant
This plant compresses the hydrogen byproduct of the Rheniformers to be
used by hydrotreating.
The RMP-regulated substances in the #5 NHT, #5 Rheniformer & LSFO K900 process are flammable hydrocarbons and NH3.
Penhex-Isomerization
The Penhex-Isomerization (Penhex-Isom) process consists of four plants: the
Naphtha Splitter, the Reformate Splitter, the Penhex unit, and the Caustic
Scrubber.
The Naphtha Splitter separates NHT heavy naphtha into two different streams:
bottoms (heavy components) and light ends (light components). The streams
are then sent to different plants to be further refined. The heptane and heavier
components are sent to #5 Rheniformer. The hexane and lighter components
are sent to the Penhex unit.
The Reformate Splitter reduces the benzene content of rheniformer gasoline
by stripping benzene out of the reformate before it gets blended into gasoline.
The Penhex unit upgrades the octane by isomerization of the feeds coming
from the Naphtha Splitter, Reformate Splitter, and #5 NHT. The Penhex unit
also saturates benzene to meet the U.S. EPA and California Air Resources
Board (CARB) new specifications for cleaner burning gasoline.
The Caustic Scrubber removes hydrogen chloride (HCl) from the offgas
generated at the Penhex unit. HCl reacts with water to form hydrochloric acid,
which can shorten the life of downstream piping and equipment. HCl also can
react with NH3 and ammonium salts that can plug downstream valves,
instruments, and furnace burners.
CUSA 2013
2-17
February 2013
SITE SAFETY PLAN

10:06:48 AM
The RMP-regulated substances in the Penhex-Isom process are flammable
hydrocarbons.
2.3.4
Hydroprocessing Refinery Business Unit

Hydroprocessing consists of three sections, North Isomax, South Isomax and the
RLOP. The Isomax area processes were constructed in 1965 to upgrade residuum
and gas oil streams into high-quality jet and gasoline blend stocks. RLOP was
constructed in 1983. The main purpose of the RLOP section is to produce quality
lube oil bases from low cost feed. RLOP is one of the largest suppliers of base
oils in the United States.
The North Isomax section consists of two RMP-covered processes, the Taylor
Catalytic Cracker (TKC), and the Taylor Catalytic Denitrifier/Isomerization
(TKN/ISO) Plants. The South Isomax section consists of three covered processes,
Hydrogen Manufacturing, the Solvent Deasphalting (SDA) process and #8 Plant.
The RLOP section has seven RMP covered processes: the Light Neutral
Hydrocracker (LNC), Heavy Neutral Hydrocracker (HNC), Light Neutral
Hydrofinisher (LNF), Heavy Neutral Hydrofinisher (HNF), Gas Recovery Unit
(GRU), the Hydro Flares, and a waste water treatment plant (#18 Plant).
North Isomax Section
TKC
The TKC hydrocracker is a two-stage, once-through unit with four reactors
designed to upgrade deasphalted oil from the SDA process into higher quality,
lighter products. The TKC unit demetallizes, hydrotreats, and hydrocracks the
deasphalted oil into light products such as gasoline, jet fuel, light gas oil, and
high quality FCC feed. The deasphalted oil contains high levels of sulfur,
nitrogen, and soluble metals. The demetallation reaction reduces the metals
level. In the hydrotreating and hydrocracking steps, sulfur, and nitrogen are
reduced.
The RMP-regulated substances in the TKC process are flammable
hydrocarbons and H2S.
TKN/ISO
The TKN/ISO process is a catalytic method for upgrading hydrocarbon gas
oils into high quality jet fuel, gasoline, and reformer feed. TKN/ISO also
produces LPG and sour offgas. The TKN/ISO consists of three sections; the
TKN reaction and separation section, the ISOMAX reaction and separation
section, and the distillation section. The TKN reactors remove nitrogen and
sulfur from the light gas oil feed. The ISOMAX reactors crack the TKN
product into lighter distillates. The Isocracker Splitter separates the reactor
products into gas recovery feed, gasoline and jet products, and unconverted
gas oil, which will be recycled to the ISOMAX reactors. The gas recovery
section separates products contained in a gas and oil mixture from the TKN
CUSA 2013
2-18
February 2013
SITE SAFETY PLAN

10:06:48 AM
and ISOMAX sections into sour offgas, LPG products, gasoline blending
components, and reformer feed.
The RMP-regulated substances in the TKN/ISO process are flammable
hydrocarbons and H2S.
South Isomax Section
H2 Manufacturing Plant
The H2 Plant consist of two parallel H2 Trains which utilize steam methane
reforming to convert natural gas into molecular H2 which is used in the North
Isomax and RLOP hydroprocessing units. Natural gas feed is first treated to
remove sulfur, mixed with steam and then routed into the catalyst-containing
reforming furnace where H2, CO, and CO2 are produced from the natural gas
and steam. The hot syngas is then cooled and sent through a series of shift
reactors which convert steam and CO into CO2 and additional H2. CO2 is
removed using MEA solvent, leaving a nearly pure H2 stream that then
undergoes methanation to convert trace levels of CO and CO2 into CH4. Heat
is recovered from hot process and flue gas streams and used to generate
medium pressure steam. To minimize NOx emissions, one of the two units
injects anhydrous ammonia into the flue gas stream over a selective catalytic
reduction catalyst, reducing NOx by over 90%.
The RMP regulated substance in the H2 plant is NH3.
Solvent Deasphalting Plant
The SDA plant uses a pentane solvent to convert crude residuum to
deasphalted oil. The deasphalted oil produced is fed to the TKC to be
hydrocracked and hydrotreated. The asphalt produced is cut with cycle oils
and used for residual fuel blending.
The RMP-regulated substances in the SDA process are flammable
hydrocarbons.
#8 Plant
Sour water is produced when water is contacted with hydrocarbon streams
containing NH3 and H2S. The NH3 and H2S dissolve in the water to form a
salt, ammonium bisulfide. All of the sour water produced in the Refinery is
processed by two NH3-H2S plants, which is a wastewater treatment process.
These plants process sour water to produce water that is reused in upstream
process units or sent to the effluent water treatment facilities. In addition to
purifying water, the plant produces separate streams of H2S and NH3. H2S is
sent to the SRU where the sulfur is recovered and sold. NH3 is sent to the NH3
storage area. The #8 Plant is one of the two NH3-H2S plants in the Refinery.
CUSA 2013
2-19
February 2013
SITE SAFETY PLAN

10:06:48 AM
The RMP-regulated substances in the #8 Plant are H2S, NH3 and flammable
hydrocarbons.
RLOP Section
Light Neutral Hydrocracker
The LNC is a single-stage, once-through unit designed to produce high
viscosity waxy lube oil feedstocks from a blend of vacuum gas oils from the
#4 Crude Unit. The waxy oils are dewaxed and hydrofinished in the LNF to
make high viscosity lube oils.
In the LNC, the feed is cracked and partially saturated by reacting it with
hydrogen at high temperatures and pressure over a catalyst in the reactor. The
viscosity is improved as the lower viscosity components of the feed are
cracked to form light products. The reactor products are fractionated in the
atmospheric and vacuum columns.
The #5 side cuts and bottoms from the vacuum column are sent to the LNF to
make 100 Neutral and 240 Neutral lube oils, respectively. Several light
products are produced by cracking the feed in the reactor. Jet Fuel is separated
by boiling range in the atmospheric column. Diesel is drawn from the vacuum
column along with the waxy 100N and 240N oils.
The RMP-regulated substances in the LNC are flammable hydrocarbons.
Heavy Neutral Hydrocracker
The HNC is a single-stage, once-through unit designed to produce high
viscosity waxy oil feedstocks from a blend of vacuum gas oil from the #4
Crude Unit. The high viscosity waxy oils are dewaxed and hydrofinished in
the LNF to make high viscosity lube oils.
In the HNC, the feed is cracked and partially saturated by reacting it with
hydrogen at high temperatures and pressure in the presence of catalyst in the
reactors. The viscosity is improved as the low viscosity components of the
feed are reacted to form light products. The reactor products are fractionated
in the atmospheric and vacuum columns.
The RMP-regulated substances in the HNC are flammable hydrocarbons,
NH3, and H2S.
Light Neutral Hydrofinisher
The LNF is designed to dewax and hydrofinish light and medium lube oils in
blocked or staggered operation. The products are lube base stocks. The feed to
the LNF is waxy oil from the LNC and the HNC. The oil is dewaxed and
hydrofinished by two reactors. In these reactors, the oil is reacted with
hydrogen over a catalyst at high pressure. In the first reactor, waxes are
CUSA 2013
2-20
February 2013
SITE SAFETY PLAN

10:06:48 AM
reformed into lube oil molecules to improve the product pour point. In the
second reactor, the product is hydrofinished to improve product stability.
Hydrogen-rich gas is separated from the oil product and recycled back to the
reactor inlet. The product lube oil is then separated from light oil and gases in
the low-pressure separator, atmospheric column, and vacuum column.
The RMP-regulated substances in the LNF are flammable hydrocarbons.
Heavy Neutral Hydrofinisher
The HNF is designed to dewax and hydrofinish medium and heavy lube oils
in blocked or staggered operation. The products are lube base stocks. The feed
to the HNF is waxy oil from the LNC and the HNC. The oil is dewaxed and
hydrofinished by two reactors. In these reactors, the oil is reacted with
hydrogen over a catalyst at high pressure. In the first reactor, waxes are
reformed into lube oil molecules to improve the product pour point. In the
second reactor, the product is hydrofinished to improve product stability.
Hydrogen-rich gas is separated from the oil product and recycled back to the
reactor inlet. The product lube oil is then separated from light oil and gases in
the low pressure separator, atmospheric column, and vacuum column.
The RMP-regulated substances in the HNF are flammables.
Gas Recovery Unit
The RLOP GRU was designed to process light end vapor and liquid produced
in hydrocracking and hydrofinishing operations. The feed to this unit comes
from the LNC, HNC, LNF, HNF, TKC, Hydrogen Recovery Unit, and the
Refinery mixed LPG tank. The GRU separates these streams into sour offgas,
LPG products, gasoline blending components, and reformer feed.
The RMP-regulated substances in the GRU are H2S and flammable
hydrocarbons.
Hydro Flares
The Hydro Flares (33 Plant) are used to safely combust relief gases from the
Heavy Neutral Cracker, Light Neutral Cracker, Light Neutral Finisher, Heavy
Neutral Finisher, and the Gas Recovery Unit. 33 Plant also houses the liquid
ammonia storage drum (V-3396) that supplies the ammonia injection to the
RLOP DeNOx units.
The RMP-regulated substance in 33 Plant is NH3.
#18 Plant
The #18 Plant is the other of two NH3-H2S plants in the Refinery, and was
designed to remove H2S and NH3 from wastewater streams stored in the sour
water tank. The plant processes sour water to produce water that is reused in
CUSA 2013
2-21
February 2013
SITE SAFETY PLAN

10:06:48 AM
upstream process units or sent to the effluent water treatment facilities. In
addition to purifying water, the plant produces separate streams of H2S and
NH3. H2S is sent to the SRU where sulfur is produced. NH3 is sent to the NH3
Storage area.
The RMP-regulated substances in the #18 Plant are H2S, NH3 and flammable
hydrocarbons.
2.4
Definitions
Human Error
Departure from acceptable or desirable practice on the part of an individual that

can result in unacceptable or undesirable results.
Human
Factors
A discipline concerned with designing machines, operations, and work

environments so that they match human capabilities, limitations, and needs.
Human Factors can be further referred to as environmental, organizational, and
job factors, and human and individual characteristics which influence behavior at
work in a way which can affect health and safety.
Richmond
Refinery
Human
Factors
Threshold
Human factors issues which could result in activation of the Community

Warning System at Level 2 or Level 3 or situations that have the potential to
result in a Major Chemical Accidents or Releases.
Inherently
Safer Systems
Incident prevention and reduction strategies at the Inherent or Passive Levels.
Latent
Conditions
Latent conditions are human factor issues that have not been resolved. These
types of conditions may exist in areas of a refinery and may lie unrecognized
until combining with active failures (an appropriate or inappropriate action) to
result in an incident.
MCAR
Major Chemical Accident or Release means an incident that meets the definition
of a Level 3 or Level 2 Incident in the Community Warning System incident
level classification system defined in the December 14, 2004, Contra Costa
County guideline for the Community Warning System as determined by the
Department; or results in the release including, but not limited to, air, water, or
soil of a Regulated Substance and meets one or more of the following criteria:
(1)
Results in one or more fatalities;
(2)
Results in greater than 24 hours of hospital treatment of three or more

persons;
Causes on- and/or off-site property damage (including cleanup and
restoration activities) initially estimated at $500,000 or more. On-site
estimates shall be performed by the regulated stationary source. Off-site
(3)
CUSA 2013
2-22
February 2013
SITE SAFETY PLAN

10:06:48 AM
estimates shall be performed by appropriate agencies and compiled by
Health Services, or
(4)
CUSA 2013
Results in a vapor cloud of flammables and/or combustibles that is more

than 5,000 pounds.
2-23
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
3.0
Risk Management Program Elements
3.1
Introduction
The intent of the California Division of Occupational Safety and Health (Cal/OSHA)
PSM program is to prevent or minimize the consequences of catastrophic releases of
toxic, reactive, flammable, or explosive chemicals. Specifically, the PSM regulations are
intended to eliminate, to a substantial degree, the risks to which workers and the public
are exposed from the operation of petroleum refineries, chemical plants, and other
industrial facilities. The Refinery applies the PSM program to the entire facility, not just
to processes that are covered by EPAs RMP or Californias Cal/ARP regulations.
The foundation of the Refinerys Safety Program is CUSAs safety culture and corporate
OE vision, as discussed in Section 1.0, Introduction. Management of the Refinerys
Safety Program builds on this foundation to establish a disciplined system for managing
process safety work processes.
3.2
Safety Program Management

The Refinerys senior managers have the overall responsibility for compliance with all
corporate standards and government regulations, including Cal/OSHA PSM, RISO,
Cal/ARP, and RMP regulations. The Refinerys Operational Excellence Management
System (OEMS) provides a framework to ensure Refinery personnel are able to integrate
all RMP, Cal/ARP, RISO and PSM program elements into Refinery work processes. A
summary of the process safety and human factor elements and how they are implemented
at the Refinery is presented in Sections 3.0 and 4.0, respectively. Lines of authority for
the various elements are shown in Figure 3-1.
OEMS consist of three parts: Leadership Accountability, OE Expectations and
Management System Process. The three parts comprise a disciplined approach to
establish a vision and objectives, and to assess, plan, implement, and review OE program
elements to comply with corporate and regulatory requirements. OEMS also ensures that
the OE program elements are periodically assessed for compliance and solutions
implemented to close any identified gaps.
Leadership Accountability
The single largest factor for success in OE is leadership. The Refinerys leaders are
focused not only on getting results, but getting results the right way with behaviors in
accordance with Chevrons values. They are accountable for stewarding the Refinerys
OEMS, and for both enabling and delivering OE performance.
By their actions, the Refinerys leaders:
CUSA 2013
Cascade, manage and drive execution;

Reinforce the OE culture;
Instill operational discipline every task the right way, every time; and
3-1
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Ensure that they and the entire Refinery workforce comply with OE
requirements.
Through personal example, the Refinerys leaders demonstrate that zero whether
related to process safety, personal safety, health, environmental, reliability, or efficiency
incidents is attainable.
OE Expectations & Policies
OE Expectations are CUSA-specific requirements for the management of safety, health,
environmental performance, reliability and efficiency. The expectations include
compliance with all government laws and regulations. Refinery Instructions (RI) are the
primary method of setting and communicating expectations for the process safety and
human factors program elements at the Refinery. These instructions are available on the
Refinery Information Server, which is the Refinerys internal web page with pertinent
information accessible to all personnel. Each RI is owned and maintained by an
appropriate organization within the Refinery. The manager of each organization dedicates
subject matter experts to periodically review and update the RIs. Each RI is reviewed and
approved by that manager and forwarded to senior managers for approval before taking
effect. Senior managers are often directly involved in the development and revision of
RIs. Refinery employees responsible for RI modifications must communicate those
changes to all affected employees.
Prior to changing a process safety or human factors program element, the originator of
the change solicits input from the other element owners. This is done to ensure changes to
one element do not inadvertently affect other elements.
Management System Process
The Management System Process begins with defining a vision of success and setting
objectives. The vison and objectives drive the Refinerys Business Plan. The Refinerys
Vision is to achieve and sustain world-class, operationally excellent performance. There
is no measure of the Refinerys performance with a higher priority than operating safely,
reliably, and with concern for the health and well-being of the workforce, surrounding
communities and the environment.
The Refinerys Vision is to systematically manage OE to:
Achieve an incident- and injury-free workplace;

Promote a healthy workforce and mitigate significant workplace health risks;
Identify and mitigate environmental and process safety risks; and
Operate with industry-leading asset integrity and reliability.
Strategies to achieve the OE Vision are to:
CUSA 2013
Complete the right task, the right way, every time;

Improve process safety to prevent Loss of Containment (LOC) events;
3-2
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Improve workforce fluency in PSM; and

Ensure the workforce has the right skills and competencies.
The Refinerys metrics and targets are communicated to employees each year. The OE
metrics are:
Personal safety performance measured by Cal/OSHA recordable-injury rate;

Process safety performance measured by the American Petroleum Institute (API)
Loss of Containment metric; and
Environmental performance measured by the number of spills, releases, agency
citations and community impact.
These OE metrics and targets are updated throughout the year, and are communicated and
reviewed during team meetings, through the Refinerys web page, business plan roll-out
meetings, and management communications.
In addition to tracking actual events, the Refinery tracks and reports leading indicators or
proactive metrics. Leading indicators are predictive indicators that may be used to
identify a weakness that can be corrected before an actual event occurs. Examples of
process safety leading indicators include the following: overdue process hazard analysis
(PHA) recommendations, days exceeding alarm limits, and overdue pressure relief device
tests.
Senior management and employees are held accountable for meeting the Refinerys OE
metric targets. Leading metrics are visible to all employees on the Refinerys web page
and are updated daily. The CUSA Incentive Plan rewards all employees for meeting
safety and environmental goals. Additionally, the Refinery has monthly process safety
metric targets for individuals, and awards employees who meet those targets.
Continuous Management Commitment
Managers focus on directing the Refinerys OEMS for continual improvement and
integrating OE into its business plans. They prioritize OE plans to focus on the highestimpact items in alignment with the Refinerys Vision and objectives discussed above.
They also provide resources and monitor progress on plans until a successful conclusion
is reached. Managers must:
CUSA 2013
Understand potential risks;

Understand requirements;
Assess and audit for effectiveness;
Prioritize gaps;
Provide resources including subject matter experts;
Direct implementation;
Review progress against plans; and
Verify compliance.
3-3
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
OE element sustainability and improvement reviews take place throughout the Refinery
to ensure progress towards meeting program goals and to discuss process improvement
opportunities. All compliance-required records relating to the program elements are
maintained for at least five years. The entire program is audited internally for compliance
once every three years. Action items resulting from this audit are resolved in a timely
fashion. Metrics are reviewed by the subject matter experts and the management sponsors
to discuss their effectiveness on the applicable OE element. These reviews provide the
forum to look back, share lessons learned and make recommendations to improve the
program. The Refinerys management system activities are further discussed below:
Organizing Each OE element is assigned to a Refinery manager who has the

overall accountability. These individuals and the relevant lines of authority are
defined in Figure 3-1.
Implementing Refinery personnel are provided with initial training on the

applicable process safety procedures. Refresher training is provided on an asneeded basis. Training is conducted following any changes to the process safety
procedures.
Findings from investigations, PHAs or other processes are communicated to

the appropriate personnel in various ways, which may include e-mails,
bulletins, training requiring sign off, or the Refinery intranet.
Controlling Management and the subject matter experts responsible for each
process safety prevention program element periodically conduct internal reviews
or audits against the goals and objectives of the element. The procedures are
reviewed, revised, and approved to ensure that they remain accurate and reflect
the current practices.
Verifying and Improving CUSA and Refinery senior management verify and
improve the Refinerys OE programs through:
CUSA 2013
Annual OE assessments;
Field audits of high-risk process safety activities;
Verification and validation of audit findings;
Field audits of completed solutions from loss and near-loss investigations;
Reviews of significant process safety incidents to ensure the quality of
investigations and implementation of appropriate solutions to prevent
reoccurrence;
Participation in joint management-employee committees on health, personal
safety and process safety so that representatives from organizations
throughout the Refinery have an opportunity to communicate their safety
concerns and discuss progress on critical safety initiatives;
3-4
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
CUSA 2013
Review of process safety, personal safety and environmental metrics to set

targets and identify improvement opportunities; and
Ensure adequate progress on action items from audits and safety meetings.
Review of progress is primarily tracked in databases, dashboards or in
meeting minutes.
Resources
Necessary expertise to support the Refinerys work processes is provided
through dedicated safety, technical and inspection groups. These groups
possess a combination of technical training and practical hands-on experience
which is necessary to not only solve problems and implement solutions, but to
effectively communicate and enforce the need to implement the various
elements of the Safety Plan. When a special situation requires outside
expertise, necessary resources are assembled from other CUSA refineries,
operating companies, or contract specialists.
3-5
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Figure 3-1
Lines of Authority and Individuals Responsible for
Cal/ARP, RISO, and PSM Program Elements
CUSA 2013
3-6
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
3.3
Process Safety Information

The Refinerys process safety information (PSI) program was developed in accordance
with Section 2760.1 of the Cal/ARP regulations.
PSI is compiled during the design and construction of each process. The PSI is updated as
needed when any process changes or additions are made and it is retained for the life of
the process or equipment plus 30 years.
The development, dissemination, and use of PSI is vital to the effective operation of the
Refinery. Personnel use PSI regarding chemical hazards, equipment specifications, and
operating limits in daily operation and strategic decision making. Accurate and complete
PSI that is readily accessible to personnel is a basic component of any prevention
program.
Established procedures, documented in RI-362 Process Safety Information, ensure that
PSI is up to date, accurate, and readily available to employees participating in PHAs. PSI
is kept current by following the Refinerys established management of change (MOC)
and prestart-up safety review (PSSR) programs. Electronic files of most PSI are
maintained on the Refinery Information Server. Locations of electronic and hard copies
of all PSI are specified in RI-362. Personnel have access to either the hard copies or
electronic copies on a 24-hour basis. This provides personnel affected by processes the
ability to identify and understand the hazards posed by each process. The following PSI
is particularly important and documents are available electronically on the Refinery
Information Server.
Information pertaining to the materials in the process:
Material safety data sheets (MSDS) are maintained for each regulated substance
and includes the following information: toxicity information, permissible
exposure limits, physical data, reactivity data, corrosivity data, and thermal and
chemical stability data; and
Maximum Intended Inventory calculations/worksheets.
Information pertaining to the technology of the process:
Process flow diagrams for each process (PFDs);
Process chemistry (included in Operating Manuals); and
Safe upper and lower operating limits and an evaluation of the consequences of
deviations from those limits (included in Operating Manuals and Safety
Instruction Sheets).
Information pertaining to the equipment in the process:
Materials of Construction;
Electrical Area Classification;
CUSA 2013
3-7
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
3.4
Relief System Design and Design Basis;
Piping and Instrumentation Diagrams (P&IDs);
Ventilation System Design;
Design Codes Employed;
Material and Energy Balances;
Safety Systems;
Electrical Supply and Distribution Systems; and
Equipment Specification documentation (e.g., SIS, EDS sheets).
Clearly written safe work practices and operating procedures, especially for high-risk
critical tasks, are critical to the safe operation of the Refinery and to reduce the likelihood
of a release of hazardous chemicals or energy that could impact employees, the
community or the environment. Applied together, RI-102, Procedures for Instructions,
Standards, and Manuals, the Electronic Operating Manual (EOM) Guidebook, and RI374, Safe Work Practices, ensure that operating procedures and safe work practices are
consistent and accurate. These practices and procedures were developed in accordance
with Section 2760.3 of the Cal/ARP regulations.
Safe Work Practices include, but are not limited to:
Respiratory Protective Equipment & Ventilation (RI-338);

Hot Work and General Work Permits (RI-341);
Control of Entry Into Process Areas (RI-375);
Electrical Safe Work Practices (RI-389);
Safe Firing of Furnaces and Boilers (RI-9025);
Control of Hazardous Energy (RI-9900) (includes lockout/tagout
lines/equipment opening); and
General Procedures for Entering/Working in Confined Spaces (RI-9920).
and
Electronic copies of operating procedures are available to all employees. Paper copies of
emergency operating procedures are available in the control room of each process unit.
The Refinerys operating manuals include the following sections and appendices:
CUSA 2013
Process description;
Normal operations, including start-up and shutdown;
Emergency procedures, including shutdown;
Routine duties;
A Consequences of Deviation (COD) table which identifies safe operating limits
and the consequences of operating outside those limits. The COD tables explain
3-8
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
the steps to correct or avoid the consequences of deviating outside the identified
operating limits, including initiation of emergency shutdown;
A health and safety section which provides a brief description of the chemicals
and the associated hazards (including special or unique hazards) and engineering
and administrative safeguards (i.e., ventilation, personal protective equipment
(PPE) used to prevent exposures, etc.); and
A description of all safety systems (i.e., alarms, interlocks, shutdowns), their
functions, and their set points.
Experienced plant operators are trained on the manual writing process and are utilized to
create and maintain those procedures.
The Refinerys Electronic Manual Management System (EMMS) ensures that operations
and maintenance procedures and manuals are both current and accurate. The EMMS
database allows employees to review and update documents according to a regular
schedule. Operations procedures and manuals are reviewed at least every three years,
maintenance procedures every five years.
The Refinerys MOC process is required for all non-cosmetic changes to procedures and
manuals. Any revised documents are routed through the RBU for review and approval.
In addition, at the end of each calendar year, each RBU Manager is required to certify
that the operating procedures for their area are current and accurate as part of the
Refinerys annual compliance certification process.
A description of the steps taken to include human factors into the Refinerys operating
procedures is available in Section 4.6.
3.5
The Refinery relies on the expertise of CUSA employees and contractors at all levels and
disciplines to ensure personal safety, process safety and reliable operations. This is
achieved by consulting with all Refinery workers to ensure consideration of their
knowledge and experience in all applicable areas of the SSP. The Refinery has developed
a written plan of action regarding employee participation in all aspects of the SSP. This
written plan, which was developed in accordance with Section 2760.1 of the Cal/ARP
regulations, is documented in RI-361, Employee Participation Plan. The Employee
Participation Plan fosters ongoing engagement between management, employees and
contractors. It encourages active participation in the design, development,
implementation and continual improvement of process safety activities and systems.
Worker involvement will help ensure that all perspectives are considered and that the best
ideas are implemented.
The Employee Participation Plan and Refinery policies ensure that:
CUSA 2013
3-9
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Refinery workers are consulted on the conduct and development of PHAs

performed pursuant to Section 2760.2 of the Cal/ARP regulations. The Refinery
requires participation by plant operators and engineering personnel as members of
the PHA teams. Other workers with responsibilities relating to specific processes
are consulted prior to and during the PHA. Worker involvement is documented in
PHA reports; and
Refinery workers and their representatives are consulted on the development of

all elements of the process safety program and the emergency response program.
Examples of this participation include the following:
Operations and maintenance workers are actively involved in the development

and review of procedures, with participation documented in the EMMS;
Operations and maintenance workers are integral members of the required

incident investigation teams, with participation documented in incident
reports;
Operations and maintenance workers are consulted regarding the appropriate

type and frequency of training;
Operations and maintenance workers participate in various safety activities,

including the Incident & Injury Free Committee, Joint Health & Safety
Meetings, the PSM Steering Committee, with participation documented in
meeting minutes; and
Operations and maintenance workers participate in MOC activities such as

Health & Safety Evaluations and PSSRs, which are documented in the MOC
database.
A description of the steps taken to include human factors into the Employee Participation
Element is set forth in Section 4.1.
3.6
Training
The Refinery training program ensures employees have necessary skills and knowledge
in order to perform their jobs in an incident-free manner, and in compliance with all
applicable laws, regulations, and policies.
One of the purposes of the Refinerys written training plan is to provide affected
personnel with an understanding of the types and causes of potential incidents or
deviations within the process and the hazards associated with the process.
The operator training plan is outlined in the Operations Training Process Manual.
Maintenance personnel training is listed in RI-368, Mechanical Integrity, and
contractor training is addressed in RI-366, Contractors. The training program was
developed in accordance with Section 2670.4 of the CalARP regulations and is
comprised of the following:
CUSA 2013
3-10
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Fundamentals training;
Plant or equipment specific formal training;
Training provided as a result of the MOC program, which includes training on
updated or new procedures;
Refresher training; and
Training documentation.
All operators receive initial training in safe work practices and basic operating principles
prior to assignment. The operators receive training specific to the operations of each
process once they are assigned to a process unit. The training criteria are documented in
job dimension documents that list the knowledge required (e.g., safe operating limits,
safety system set points) and skills to be demonstrated (e.g., emergency shutdown,
lockout/tagout procedures). Various means are used to verify competency, including
written and oral examinations, demonstrations, and on-the-job training. Documentation of
the training is forwarded to the Development Department for filing and tracking.
Refresher training on specific operating procedures (e.g., normal operations, start-up,
shutdown), critical, seldom-done tasks, emergency procedures, MOC reviews, safe work
practices (e.g., limiting contractor access, lockout/tagout), and company-wide practices is
provided and includes the following:
Computer based training on job specific PSM requirements;

Simulator or oral discussion / demonstration when applicable;
Monthly hypotheticals or table top drills;
Computer based training on safe work practices;
Just in time training on startup, shutdown and related procedures before
turnarounds; and
Quarterly process safety topics.
The Refinerys current training schedule was developed with employee consultation and
allows refresher training to be conducted at a minimum of every three years. Training
documentation is tracked in the training database or crew turnover logs.
Training may also be required as a result of the MOC process. The type of training is
determined according to the complexity of the change (e.g., email notification, hands
on/simulator training, classroom training). Training records are forwarded to and
maintained by the Learning & Development (L&D) Department. The RBU is responsible
for ensuring that the necessary training is conducted prior to implementation of a change.
This training was developed in accordance with the MOC program requirements of
Section 2760.6 of the Cal/ARP regulations. A description of the steps taken to include
human factors into the Training Element is set forth in Section 4.2.
CUSA 2013
3-11
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
3.7
Mechanical Integrity
The Refinery has developed a mechanical integrity program pursuant to Section 2760.5
of the Cal/ARP regulations. Proper design and maintenance of equipment and safety
systems is essential to prevent releases of hazardous materials.
The mechanical integrity program applies to fixed equipment, rotating equipment,
instrumentation, and electrical systems. This includes pressure vessels, storage tanks,
piping systems (including piping components such as valves), compressors, pumps,
pressure relief devices, and vent systems, all of which are inspected following API
guidelines. The mechanical integrity program also applies to emergency shutdown
systems and process controls, including monitoring devices, sensors, alarms, and
interlocks.
RI-368, Mechanical Integrity, describes the Refinerys policy and standards for the
mechanical integrity program, which consists of the following:
Quality assurance procedures Members of the engineering, maintenance,

inspection, and purchasing staff develop and maintain purchasing documents for new
and modified equipment. They review all new equipment against the purchasing
documents to ensure that the equipment is fabricated in accordance with the
specifications. They also conduct appropriate checks and inspections to ensure that
the equipment is installed properly and is consistent with the design specifications
and the manufacturers instructions. In addition, all personnel and work involved with
welding follows ASME, AWS and NBIC approved written QA/QC procedures.
The preceding quality assurance procedures are often performed in conjunction with
the MOC and PSSR programs. The Purchasing and Materials Management
Department, in conjunction with engineering, reliability, and maintenance personnel,
develops and maintains purchasing documents for spare parts. This ensures that all
maintenance materials and spare parts are suitable for the process.
Written maintenance procedures for process equipment Written procedures

(including step-by-step instructions and required PPE) are developed for maintaining
process equipment. Copies of the procedures and checklists used are available on the
Refinery Information Server and/or hard copies may be retained in the Maintenance
Supervisors office. Changes or additions to procedures identified in the course of
maintenance activities are communicated to the Development Department and the
procedures are updated by the respective owner utilizing the MOC process. Regularly
scheduled maintenance (preventive maintenance) requests are automatically
generated by a computer-based maintenance work management system. Nonpreventive maintenance activities are also performed through the same work
management system (i.e., operators and engineers submit work requests to be
scheduled by the Maintenance Planner/Scheduler). The Maintenance employees
complete the work order documentation and the maintenance history records are
updated in the work management system.
CUSA 2013
3-12
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
The Refinerys EMMS ensures that maintenance procedures and manuals are both
current and accurate. The EMMS database provides employees a method to review
and update documents according to a regular schedule. Maintenance procedures are
reviewed every five years.
Maintenance employee training The Refinery carefully assesses each applicant

for employment and only hires maintenance personnel with the skills and knowledge
pertinent to their required job tasks. Additional skills training is provided on an asneeded basis or when required by applicable codes and standards. The Development
Department maintains documentation of skills training (e.g., union training program,
community college training, specialty equipment training) and compliance training
for maintenance employees. During initial employee training and refresher training,
maintenance employees are provided with an overview of the process, the hazards
associated with the process, and safe work practices. The Development Department
maintains initial and refresher training records including content of training,
instructor, and means used to verify competency. All welding-related work and
records are carefully monitored and controlled through the Refinery Inspection
Department in accordance with ASME, AWS and NBIC requirements.
Inspection and testing procedures for critical equipment Inspection and testing
procedures and frequency of testing for each piece of critical equipment are
developed and documented by the Equipment Reliability group. These procedures
and their frequency are based on jurisdictional requirements, manufacturers
recommendations, recognized and generally accepted good engineering practices,
operating history, and failure prediction and prevention. Completed inspection and
test documents include the inspectors name, date of the inspection or test,
identification of the equipment, inspection and test procedures, and the results of the
inspection or test are retained by the Maintenance and Reliability Department.
Equipment inspectors or reliability analysts review the results of each inspection or
test to ascertain whether the equipment is within the acceptable limits and to
determine if the frequency of the inspections should be adjusted. Equipment outside
of the engineering standards is removed, repaired, or replaced unless temporary
protective measures can be put in place until the deficiencies are corrected. Inspection
and test results are maintained for the life of the equipment. Some examples of
inspections and tests include internal and external inspections, thickness monitoring,
ultrasonic/radiography inspection, hydrotesting and infra-red scans. Instrumentation
and control systems are also tested to ensure they will function as intended.
Structural Integrity - The guidance for Cal/ARP Seismic Assessments is followed

for maintaining structural integrity. The integrity of operating equipment structures is
maintained by an ongoing inspection program. All covered processes meet
earthquake design standards per the Uniform Building Code, Zone 4, for the year the
plant was built. All additions and modifications to equipment and structures meet
UBC Zone 4 standards for the year constructed.
CUSA 2013
3-13
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
All buildings within the Refinery were evaluated in 1999 using the API
Recommended Practice 752. Each building was screened for hazards, function and
occupancy levels. Consequence modeling was performed for each building that met
the occupancy conditions. The results of the modeling generated an action plan to
ensure that each building meeting the occupancy conditions have mitigations in-place
to reduce the risk associated with the surrounding hazards. All buildings have
completed mitigation plans.
Area inspectors perform visual reviews of structures within their respective areas on a
routine basis. A licensed civil engineer is available to assess potential concerns. If
warranted, a maintenance work request is generated to resolve the concern. In
addition, the structural systems are inspected after any event (i.e., fire, explosion,
earthquake) that could have resulted in structural damage. Any abnormalities in the
structural systems observed by Refinery personnel during their regular duties are
entered into our maintenance work management system for repairs.
3.8
Management of Change
Changes within a refinery are sometimes necessary to address safety, environmental, and
operational concerns. A change made in one part of the process may have unintended
effects on other parts of the process, or other processes, because the Refinery is an
integrated system. These changes are therefore appropriately scrutinized to avoid adverse
effects to work and public safety and to the environment.
The Refinery has implemented a written MOC procedure, documented in RI-370,
Management of Change, which was developed in accordance with Section 2760.6 of
the Cal/ARP regulations. This MOC procedure ensures that all changes to the following
are properly managed:
Process chemicals (i.e., raw materials, intermediate products, solvents);

Technology (i.e., operating parameters, catalysts, rates);
Equipment (i.e., materials of construction, equipment specifications); and
Procedures (i.e., emergency response, maintenance, operating).
MOC does not apply to a replacement in kind, which is defined as a replacement that
satisfies the design specifications for the equipment being replaced.
Refinery personnel verify that the Refinerys process equipment complies with
recognized and generally accepted good engineering practices. Designated personnel also
verify that all equipment is designed, maintained, inspected, tested, and operated in a safe
manner. All new designs follow the CUSA Engineering Standards (CES). Exceptions to
this practice are managed through a documented waiver process that includes appropriate
reviews and approvals. Other methods to ensure compliance with CES include Lead
CUSA 2013
3-14
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Engineer approval of all engineering work orders and a Quality Management process to
reinforce craft quality.
Changes are classified as permanent, temporary, or emergency. Emergency changes are
allowed during off-hours and holidays; however, at a minimum, the MOC process
requires that the impact of the change on Health and Safety has been assessed,
Communication and Training requirements have been met, and when required, a PSSR
has been completed prior to start-up. Temporary changes require the identification of a
maximum allowable time frame for the change. Changes to Refinery equipment or
processes are implemented as a result of the Refinerys business and safety decisionmaking process. An MOC is typically initiated by the individual who has been assigned
the task to carry out a proposal as part of the routine work process.
Personnel assess the potential impact of the change on safety and health through a Health
and Safety Evaluation procedure for minor changes. A HAZOP or What-if/Checklist is
conducted for additions and major changes that require a more structured evaluation. The
following steps are taken to ensure proper implementation of the change:
Subject matter experts or other employees with technical expertise are involved in
making, reviewing or approving the change;
Equipment is fabricated and installed in accordance with the design
specifications;
Employees whose job tasks are affected by the change are trained prior to the
startup of the process;
Process safety information is updated as necessary; and
Operating procedures are updated as necessary in accordance with the change
being made, and reviewed by a subject matter expert; the MOC cannot be closed
until the procedure update is verified as posted to the Refinery EOM.
Most changes are relatively simple and require only communication of the change taking
place. Each person affected by that change is sent a notification of change before the
change is put into service. For more complex changes, a training package is developed
and delivered to the affected employees, either on shift for minor changes, or in a
classroom setting for major changes.
The person that authorizes the start-up of a change is typically an Operating Assistant.
That person is responsible for determining that the assigned individuals have completed
all required tasks and reviews identified on the MOC form before the change is put into
service.
If it is considered necessary to use marked-up copies of P&IDs temporarily to expedite
start-up, the MOC tracking system is used to verify completion of the update process.
The individual that authorizes the start-up of any change is responsible for ensuring that
all PSI, including P&IDs, are updated prior to start-up of the change. The P&ID update
process is described in RI-362 Process Safety Information.
CUSA 2013
3-15
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
The MOC records are tracked according to the assigned tracking number. The MOC
records and documentation of completion of the tasks and reviews are maintained for the
life of the process plus 30 years.
A description of how the Refinery complies with the requirement to manage
organizational change is set forth in Section 4.7.
3.9
Pre Start-up Safety Review

The Refinery has a written Pre Start-up Safety Review (PSSR) procedure and checklist,
which is documented in RI-367, Prestart-up Safety Review. These procedures were
developed in accordance with Section 2760.7 of the Cal/ARP regulations. PSSRs provide
a system of checks and verifications to ensure that equipment is suitable for service and
meets required specifications prior to startup in order to prevent the release of hazardous
materials. In addition, PSSRs require that necessary operating, maintenance and
emergency procedures have been written and that employees have been trained to safely
operate the equipment.
The PSSR process takes place prior to start-up of a new unit or the startup of an existing
unit after a shutdown/turnaround. Changes requiring an MOC may also trigger a PSSR.
This does not apply to MOCs initiated only for changes to PSI as such changes do not
require the startup/shutdown of a process unit or equipment.
The PSSR facilitator convenes a team with knowledge of the process and expertise in
their field. Team members can include representatives from the business unit,
maintenance group, engineering groups, and others depending on the nature of the
change. Team members are responsible for verifying that the following actions have been
taken prior to the introduction of regulated substances:
Construction and equipment are determined to be in accordance with design

specifications;
Safety, operating, maintenance, and emergency procedures are in place and are
adequate for safe operations;
For new processes, a PHA has been performed and recommendations have been
resolved or implemented before start-up;
PSI, including P&IDs, has been generated or updated, as appropriate;
Communication to and/or training of each employee involved in operating the
process has been completed;
Quality assurance goals of mechanical integrity have been met; and
Verification of particular steps is performed by the appropriate personnel from the
team, and requires sign-off in the MOC and/or PSSR database.
All required signatures must be obtained and any exceptions documented prior to startup.
PSSR exceptions are outstanding items that may or may not be required for safe startup.
CUSA 2013
3-16
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
The PSSR facilitator and the appropriate Refinery Business Manager (or delegate) must
review and agree on exceptions prior to start-up of the unit or equipment. Exceptions will
be tracked to completion in the MOC or PSSR database as appropriate. Each exception
will be specific, assigned to an individual, have a due date and be identified if it must be
completed prior to start up. Authorization for startup requires completion of RI-367,
Appendix I, II or III, as appropriate.
PSSR records are maintained for the life of the process plus 30 years.
3.10
Compliance Audits
Trained personnel perform internal compliance audits at least every three years to review
and evaluate the written documentation/records and implementation of the Cal/ARP and
RISO programs. The compliance audit program, documented in RI-373, Compliance
Audit, was developed in accordance with Section 2760.8 of the Cal/ARP regulations.
Audits help verify compliance with established standards/regulations and identify any
gaps that exist to ensure that process safety systems function in a manner that protects the
community, employees and the environment from accidental releases of hazardous
chemicals.
The OE Audit Group assigns an Audit Team Lead. This person is responsible for leading
the audit team and ensuring all of the goals and objectives of the audit are fulfilled. The
balance of the audit team is comprised of qualified personnel knowledgeable in the
process. A Refinery Audit Liaison ensures adequate notifications are made, and interview
schedules and meeting locations are defined. The OE/PSM Manager assists in the
removal of barriers which may impede the teams ability to succeed and works with the
other resource owners to ensure that findings requiring mitigation have adequate
resources committed to resolve issues in a timely fashion.
The audit team utilizes a field assessment and audit checklist to perform the following:
An assessment of the written prevention program elements;

A review of records (i.e., completed hot work permits, MOC documents, incident
investigations, equipment records, etc.) to assess implementation of the written
program elements;
Interviews with employees and their representatives to assess their understanding
of applicable programs (for example, whether personnel have a basic
understanding of the mechanical integrity program); and
Interviews with key personnel (those with primary responsibility for each element
within the program).
The audit team members formulate findings for improvement. The results of the
compliance audit are communicated to the Refinery Leadership Team during a closing
meeting and in an audit report. The appropriate PSM element owners are responsible for
reviewing the findings, determining appropriate resolutions, assigning responsibility for
CUSA 2013
3-17
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
each resolution, and compiling status reports of progress made in implementing the
resolutions. The periodic status updates are maintained in an audit database. The Refinery
retains the two most recent compliance audit reports. The Refinery tracks to final
disposition the resolutions formulated during all compliance audits. Audit findings are
addressed or resolved within an agreed-upon due date between CCHMP and the
Refinery.
3.11
Incident Investigation
The Refinerys incident investigation procedure, documented in RI-371, Near Loss,
Event Reporting and Incident Investigation, was developed in accordance with Section
2760.9 of the Cal/ARP regulations. RI-371 establishes procedures for investigating each
incident that results in, or could reasonably have resulted in, an accidental release of a
regulated substance causing injuries or property damage.
Incident investigations provide the Refinery with the means to identify root causes or
systemic factors and implement solutions to prevent future incidents.
Business Unit Managers are responsible for ensuring that personnel in his/her area
promptly report any incident or near miss, including those with potential for catastrophic
release. All incidents are reported into the Refinerys Incident database. Personnel trained
in the methodology to be used (includes 5 Why, Triangle of Prevention (TOP), and
TapRoot) are assigned as investigation team leader and/or investigation team facilitator.
All Refinery employees are trained in TOP awareness. The experience and number of the
other team members are dependent upon the nature of the incident. Typically, the
incident investigation teams are comprised of a team leader, and other employees
(including contract employees) knowledgeable in the operation, design, and maintenance
of the process. Significant incidents (Level 3 severity classification) require the use of the
TapRoot methodology (root cause analysis), which incorporates human factors in the
investigation process.
The incident investigation team leader is responsible for initiating the investigation as
soon as possible, but definitely within 48 hours of the time of the incident or near miss.
The team lead selects team members for Level 1 & 2 investigations, and coordinates and
supervises investigation team activities. Team members, with team leader/facilitator
guidance, collect and analyze facts, identify root causes, develop appropriate solutions in
order to avoid a repeat occurrence, and prepare the initial investigation report. The
Management Sponsor has overall accountability for the investigation and its
documentation, confirms team leader and members, assigns team members for Level 3
investigations, ensures needed resources are available, and reviews and approves the final
investigation report.
The investigation report findings and recommendations are promptly addressed and
resolved in a timely manner. The functional work group manager is responsible to ensure
the recommendations are completed in accordance with RI-371.
CUSA 2013
3-18
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
The investigation report is entered into the Refinerys computerized incident database,
along with recommendations to prevent future occurrences and lessons learned.
Recommendations are tracked until completion. The Refinery regularly reviews metrics
to prevent corrective actions from becoming overdue and also tracks the status of
investigations so they are completed in a timely fashion. The computerized incident
database is available on the Refinery intranet. Copies of the investigation reports are
retained for a minimum of five years.
The investigation results are reviewed with employees (including contract employees)
whose job tasks are relevant to the findings in regular safety meetings, in other acceptable
forums, or through incident bulletins. The management team discusses incidents that
resulted in significant consequences as part of regular safety discussions. Select findings
distributed from other CUSA facilities are reviewed during monthly safety meetings.
Initial reporting of any incident to CCHMP is done in accordance with the CCHMP
Hazardous Materials Incident Notification Policy. This includes 72-hour and 30-day
follow-up reporting, and establishes minimum requirements for final reporting. The final
incident report includes at a minimum the following: date of incident; date investigation
began; a description of the incident; the factors that contributed to the incident and
recommendations resulting from the investigation. The incident investigation report shall
be made available to CCHMP or other applicable agencies as appropriate.
The Refinery PSM Team Leader is the single point of contact between CCHMP and the
Refinery for all MCARs. This person would be responsible for various coordination and
communication activities. If CCHMP elects to conduct an independent investigation or
Root-Cause Analysis, the PSM Team Lead will comply with RISO section
64.3.090(c)(2).
A description of the steps taken to include human factors into the incident investigation
process is set forth in Section 4.5.
3.12
Process Hazards Analysis & Action Items

A PHA is conducted on each process unit at the Refinery to systematically assess and
reduce risks associated with loss of containment of hazardous substances. Initial PHAs
have been completed on all existing process units and are performed for new processes or
major modifications to existing processes. RI-363, Process Hazards Analysis describes
the policy to ensure compliance with the PSM, RMP, Cal/ARP and RISO requirements.
PHAs are performed with the following objectives:
CUSA 2013
Identify the hazards of the substances and of the process;

Identify external events (including seismic events) that could lead to a release;
Identify possible equipment failures or human errors that could lead to a release;
Identify releases that could possibly result in off-site consequences;
3-19
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Evaluate the potential consequences and likelihood of an accidental release;

Evaluate the safeguards used to prevent or mitigate an accidental release; and
Propose recommendations that would reduce risks, including changes to
equipment design, facility or equipment siting, operating procedures, process
technology, etc.
Each PHA is conducted by a multi-disciplinary team. The PHA team is composed of a

trained team leader, an engineering representative, an operations representative, and other
specialists when needed (e.g., plant protection personnel, mechanics, inspectors,
equipment reliability specialists, environmental specialists, etc.). PHA team members
must meet qualifications set by corporate standards; exceptions require written approval
from both the PSM Manager and the respective business unit manager to proceed with
the PHA. The team considers the possible causes and potential consequences of
deviations to identify hazardous conditions, analyze existing safeguards, and make
recommendations for changes where appropriate. The PHA team uses a qualitative
evaluation tool, the CUSA Integrated Risk Prioritization Matrix, to assess the severity,
likelihood and relative risk of each cause-consequence scenario. The PHA documentation
is retained for the life of the process plus 30 years.
The HAZOP and What-if/Checklist methodologies are used to conduct PHAs at the
Refinery, and the methodology is selected based on the complexity of the process. Most
continuous processing/circulating systems are normally analyzed using the HAZOP
methodology. Certain support systems such as chemical injection facilities, utility
systems, truck and railcar loading, or flare systems are usually analyzed using the What-if
methodology. Checklists are used to address Human Factors and Facility Siting issues. A
Procedural PHA, which uses a variation of the HAZOP methodology, may be used for
the evaluation of qualifying procedures.
The Refinery follows the State of California and Federal OSHAs guidance for justifiably
declining recommendations from PHAs, as follows:
The analysis upon which the recommendation is based contains material factual
errors;
The recommendation is not necessary to protect the health and safety of the
employers own employees, or the employees of contractors;
An alternative measure would provide a sufficient level of protection; and
The recommendation is infeasible.
Recommendation resolutions are tracked and managed in the PHA Database. The
database is the permanent record for each recommendation. The database includes the
original team findings, the plan to resolve the potential hazard, when the action is to be
completed and the work performed to resolve the recommendation. The database also
records the person and department responsible for completing the recommendation.
CUSA 2013
3-20
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
PHA recommendations not requiring a process unit shutdown are required to be
completed within one year. Recommendations requiring a process unit shutdown are
planned to be completed during the first regularly scheduled turnaround of the process
unless such a schedule is infeasible. Some recommendations may require consideration of
temporary measures to mitigate the risk until the final solution can be completed.
Business unit mangers have responsibility for ensuring timely completion of PHA action
items.
PHAs are revalidated every five years to ensure the analysis is current and accurate. The
revalidation process includes:
Review of process changes since the previous PHA;

Review of incidents since the previous PHA;
Review of resolution of previous PHA recommendations;
Human Factors Review;
Inherently Safer System (ISS) Review;
Seismic Review;
Facility Siting Review; and
External Event Review.
Current PSI and procedures are utilized and referenced throughout the revalidation
process.
As of September 1, 2012 the Refinery has 126 open action items from PHA
studies and associated activities:
82 from PHA studies;

4 from Latent Conditions reviews;
1 from Inherently Safer Systems reviews; and
45 from Seismic walkthroughs.
Of these open action items:
CUSA 2013
18 require plant shutdowns for implementation and are scheduled for

completion at the next planned turnaround;
One PHA action item not requiring a shutdown has passed the required
one-year completion time-frame due to long materials lead time and
confirmation/testing to ensure that the implemented resolution mitigates
the hazard identified by the PHA team. A request to extend the due date
was made to and approved by CCHMP, and thererfore, this item is not
considered overdue; and
All others are scheduled for completion within the required one-year
completion time-frame.
3-21
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
CUSA selects and implements Inherently Safer Solutions to the greatest extent feasible.
PHA studies address this in the following ways.
Each PHA for an existing facility conducts an ISS review using an ISS Checklist.
The review is completed by the PHA team and may include input from subject
matter experts and persons with technical expertise. Recommendations can be
made by the team to address any questions raised or gaps identified.
Inherently Safer Solution strategies are considered in the development of

mitigations to address qualifying recommendations resulting from a PHA for
existing facilities.
New facilities or projects first undergo a screening to determine if they require a

formal ISS review. Those new facilities or projects that meet one or more of the
screening criteria will undergo a series of formal reviews during the CUSA
Project Development and Execution Process. Findings from the ISS reviews are
integrated into the project design.
Seismic Studies
The Refinery conducted a seismic review for each process at the Refinery in 1991. The
primary performance objective of the seismic assessment program is to provide
reasonable assurance that structural components and equipment maintain structural
integrity and position in the event of a seismic event to reduce the likelihood of loss of
containment of hazardous substances and minimize the impact on employees, the
community and the environment. Six major geotechnical, seismic hazards were
evaluated:
Ground acceleration;
Fault rupture;
Liquefaction;
Subsidence;
Landslide; and
Tsunami.
The nearest major fault to the Refinery is the Hayward fault, located approximately three
miles away from the Refinery at its nearest point. Due to the soil type and location of the
Refinery, the only site-specific seismic hazard of concern is ground acceleration. The
seismic review was followed by an evaluation of the process area equipment relative to
these identified hazards. The review was based on a 475-year return period earthquake
which corresponds to a 10% probability of exceedance in 50 years, which corresponds to
an estimated magnitude of 7.0 to 7.5.
Seismic walkthroughs are performed on each process unit to inspect and assess the
structural integrity of the structural components, following the guidance developed by
CUSA 2013
3-22
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
Cal/ARPs Program Seismic Guidance Committee in January of 2004 and approved by
the Region 1 Local Emergency Planning Committee (LEPC). The seismic walkthroughs
are conducted by a registered professional civil engineer and an operator familiar with the
equipment and structures contained within that unit. The walkthrough is performed in
conjunction with the unit PHA, at a minimum of every 5 years, and focuses of four main
areas:
1.
2.
3.
4.
Review of structural steel;

Review of concrete structures;
Review of anchor bolts; and
Review of concrete foundations.
Results of the seismic walkthroughs are communicated to operations management and

resolved in a timely manner similar to other PHA action items: within one year or at the
next available shutdown. Seismic walkthrough action items may result in simple
maintenance repair or may recommend additional engineering assessments to ensure
continued structural integrity.
The Refinery currently has a tsunami plan in place for the Long Wharf. Additional
tsunami data has recently become available from the California Emergency Management
Agency (Cal EMA). The Refinerys Tsunami Plan will be updated once this detailed data
is received and an analysis is completed.
A description of the steps taken to include human factors into the PHA process is set
forth in Section 4.4.
3.13
Hot Work Permits

Controlling ignition sources is vital to the Refinerys accident prevention program. The
hot work element prevents inadvertent ignition of flammables or combustibles when
performing jobs such as welding and ensures that any fires which may occur can be
readily suppressed and extinguished. Management personnel must authorize any hot
work (e.g., cutting, grinding, burning, welding, brazing) to be performed in a unit and
ensure appropriate safety precautions are taken prior to initiation of the work. The
Refinerys hot work permit program, which is documented in RI-341, Hot Work and
General Work Permits, was developed in accordance with Cal/OSHA requirements and
Section 2760.11 of the Cal/ARP regulations. The hot work permit program requires that
employees complete permit requirements certifying that the applicable portions of the fire
prevention and protection requirements are implemented prior to beginning hot work
operations.
The fire prevention procedure restricts hot work in certain areas. When grinding, burning,
welding, or brazing work is needed in these areas, an ignition source permit must be
initiated by the maintenance supervisor and approved by the local operations supervisor.
The permit is terminated when continued use of the ignition source is hazardous,
CUSA 2013
3-23
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
conditions of its issuance change, or the permitted hot work has been inactive for more
than two hours (unless tests show that conditions are still non-hazardous).
Three copies of the ignition source permit are maintained. The first is posted at the
physical location of the hot work for the duration of the work. The second is provided to
the control room file. The third is provided to Emergency Services where it is kept on file
for at least twelve months after the date of issue. The permit contains the following
information:
The effective date and time;

The place of use;
The hours during which the source of ignition may be used;
The specific location or piece of equipment where the source of ignition will be
used;
The nature of the source of ignition; and
Any special precautions or limitations to be observed before, during, or after the
use of the source of ignition, including the need for a fire watch and fire hoses or
extinguishers. The criteria for needing a fire watch are identified in RI-341. The
responsibilities and authority of the fire watch are to continuously monitor
assigned job(s), extinguish incipient stage fires, sound fire alarm when necessary,
and to use Stop Work Authority if they think that work being performed is unsafe.
Trained personnel from Emergency Services, Operations, and Maintenance perform an

inspection of the area to ensure the following prior to authorization of hot work:
3.14
The source of ignition may be safely used RI-341 requires that only an approved
apparatus be used and that personnel performing the hot work (including
contractors) be informed of the hazards and properly trained. Also, the flammable
gas or vapor content in the air must be less than 10% of the lowest content that is
flammable or explosive;
Combustible materials in areas that will be exposed during hot work are protected
or relocated;
Proper fire extinguishing equipment is available to employees performing hot
work; and
Personnel in the control room are notified prior to initiation of the hot work to
make them aware of the ignition source. This awareness allows personnel in the
control room to quickly contact the fire watch and personnel performing hot work
if continued use of the source of ignition becomes hazardous.
Contractors
The Refinerys contractor program is documented in RI-366, Contractors, which was
developed in accordance with Section 2760.12 of the Cal/ARP regulations. The
contractor program ensures that safety issues are addressed during contractor selection
and that CUSA and the contract company share responsibility for the safety of all
CUSA 2013
3-24
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
employees. The Refinery and all contract companies are jointly responsible for safety and
must ensure that contractors employees are trained in and understand the following:
Work practices necessary to perform the job;

Hazards associated with a process;
Applicable sections of the emergency response procedure; and
Applicable safe work practices.
Chevron's contractor safety management program employs a system of controls which

requires contractors to meet Chevrons standards and expectations for supporting safe
facility operations to protect contractors, employees, the community and the
environment. The Refinery requires that potential contract companies complete and
return a pre-qualification questionnaire regarding their safety programs to Contracts
Administration for review against established criteria. The questionnaire includes
confirmation that the company has an established written safety program, job
qualification employee requirements, a program for random drug and alcohol testing,
initial and refresher training programs, a behavioral based safety process and a short
service employee program. Metrics, such as Total Recordable Incident Rate, are also
considered when selecting contract companies. Contracts Administration may also
request that the contract owner submit additional documentation, such as safety training
records/logs. The contractor office audit process also includes verification of appropriate
skills and certification required to perform the job. Contract companies found to be
acceptable against the established criteria are then logged into the Preferred
Contractors list. The Contractor Health Environmental Safety Management (CHESM)
maintains files of the completed questionnaires and any additional information requested.
Contractor employees from the Preferred Contractors list are required to receive
refinery instruction training before being allowed on-site. Each contractor employee must
complete a course in general Refinery safety conducted by the Bay Area Training
Corporation/DISA (BATC) or OSCA which offers DISA/Nor-Cal/LA Refinery Safety
Orientation (DSOP/NCRSO/LARSO). In addition, each contractor employee must
complete a course in Incident and Injury Free Orientation (IIFO), emergency procedures
and Refinery-wide work practices specific to the Refinery. Training is also given on
process-specific hazards related to the area in which the contractor employee will be
working. Contractors and all employees other than operators assigned to the specific
process unit must sign in at the control room for the unit, review the emergency response
plan for the area before entering the unit, and sign out when leaving.
The Maintenance & Health, Environmental & Safety Departments audit contractor
companies periodically. The frequency of the audits is adjusted according to safety
performance history and the type of service being provided. The contract owner/CHESM
administrator ensures that each contractor provides proper training and maintains
documentation for each contract employee. The contract owner/CHESM administrator
also monitors contractor performance (i.e., compliance with stationary source safe work
practices, knowledge of types of work, and the hazards involved). Documentation of the
CUSA 2013
3-25
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
audits and on-site evaluations is maintained for a minimum of five years within the
CHESM database.
It is also critical for contractors and Refinery personnel to be aware of any unique
hazards that they may encounter prior to performing their work. A Joint Job Site Visit
(JJSV) is performed prior to the commencement of work. Additionally, evaluation and
communication of hazards is accomplished via the Lock-out / Tag-out, and/or the
Control of Entry into Process Areas work processes.
3.15
Emergency Response Program

The Refinery maintains an emergency response program designed to protect worker and
public safety, as well as the environment. As part of the emergency response program:
There is a written Emergency Response Plan (ERP) for responding to accidental

chemical releases, including releases of regulated substances. The ERP is
reviewed to ensure that it remains accurate and current. Employees receive
training in these procedures as necessary to perform their specific emergency
response duties;
There are procedures that address maintenance, inspection, and testing of

emergency response equipment;
The Refinery works closely with local emergency responders (primarily the
Richmond Fire Department) in preparing for emergencies; and
There are procedures for notifying the public and local emergency response
agencies about accidental releases.
The Refinery emergency response program is discussed in more detail in the following
subsections.
Emergency Response Plan
The ERP addresses all aspects of emergency response, including proper first aid and
medical treatment for exposures, evacuation plans and accounting for personnel after an
evacuation, notification of local emergency response agencies and the public if a release
does occur, and post-incident cleanup and decontamination requirements. The ERP is
documented in a series of Refinery Instructions, and is available to all employees. Hard
copies of the ERP, and manuals of emergency plans and procedures, are also maintained
throughout the Refinery.
The ERP is reviewed annually by the Manager of the Refinery Fire Department and
updated to ensure that it remains accurate and current. Every employee receives training
in these procedures as necessary to perform their specific emergency response duties.
The ERP includes the chemical-specific emergency response procedures for releases of
regulated chemicals. The chemical-specific emergency response plans identify the
CUSA 2013
3-26
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
characteristics of the chemical, emergency response and first aid procedures, and the
community notification system. These plans also identify concentrations of chemicals
that would trigger specific types of emergency response and when to notify the public.
In addition, all employees are trained on the ERP upon initial assignment. The level of
emergency response training corresponds to the emergency response duties of the
employee.
In addition to the ERP, the Refinery also has local Emergency Action Plans (EAPs),
which are posted in all buildings and operating area control rooms. All employees or
contractors entering a process area must review the EAP for that area prior to entry. The
EAP summarizes the first actions that are to be taken in the event of an emergency (e.g.,
stay clear of area, call emergency number, move indoors, etc.) and the means for
reporting fires and emergencies (a single three digit phone number). The EAP also has
guidelines for sheltering-in-place, evacuations, and earthquakes, as well as maps with
evacuation routes and meeting places.
Emergency Operating Procedures, which are a part of the prevention program, are
another critical component of emergency preparedness. These procedures outline the
steps to be taken to control or shut down a process unit in the event of an emergency
situation (e.g., fire, earthquake, release, etc.). Operators for the process are trained in
these procedures.
The Refinery also has various mitigation safeguards in place to minimize impact of
chemical or toxic releases. Examples include H2S scrubbers, emergency deluge systems
and administrative controls to manage ammonia and LPG inventory.
Refinery Fire Department
The Refinery Fire Department responsibilities include inspections of fire-related
equipment, permit authorization for hot work and confined space entry, security, and a
variety of other tasks related to fire prevention and emergency response. Other members
of the Refinery Fire Department are volunteers consisting of employees from the
Operations, Maintenance, and Technical Divisions. Each volunteer member receives
approximately 100 hours of training each year.
Unlike other refineries in the area that have separate teams to deal with different types of
emergencies, the Refinery Fire Department trains its personnel to handle fires in process
plants, building fires, storage tank fires, wild land fires, or fires related to transportation
modes, including ships, barges, tank cars, and railcars. Refinery Fire Department
personnel are trained in confined space, high angle, and heavy rescue procedures. In
addition, all of the full-time members are certified Hazardous Material Technicians, and
are qualified to deal with any hazardous material incident including any oil spills at the
ship and barge loading facilities. The Fire Department also responds to medical
emergencies; many members are California State Certified Emergency Medical
Technicians (EMTs).
CUSA 2013
3-27
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
A variety of emergency response equipment exists at the Refinery and includes 25

emergency response vehicles (including fire trucks), 2,500 fire extinguishers, water
deluge systems, in-plant stationary fire monitors, fixed foam systems, and a water fog
system. All of this equipment is maintained, inspected, and tested as outlined in the
Refinery Fire Department Procedures and Policies.
Coordination
The Refinery conducts emergency drills in which an off-site responding agency
(Richmond Fire Department and/or CCHMP), the Refinery Fire Department, and nonresponding employees work together to resolve the given scenario. This pre-planning
activity ensures that the members of the responding agencies are familiar with the
Refinery, the hazards of the regulated substances, the resources available at the Refinery,
and the locations of these resources. It also clearly identifies the capabilities and
limitations of each responding agency. These drills are conducted at least once a year.
The Refinery also works closely with the CCHMP for any necessary response to
hazardous material releases (such as downwind air monitoring) and to alert the public in
case of accidental releases, fires, or explosions in accordance with CCHMPs Emergency
Response Area Plan. The Refinery worked with CCHMP to establish the CWS and the
Telephone Emergency Notification System (TENS) zones, which provide incident
notification to the community.
The Refinery Fire Department also provides mutual aid to the City of Richmond Fire
Department and responds outside of the Refinery within the City of Richmond whenever
asked to do so by the city fire department. The Refinery Fire Department also belongs to
an industrial mutual aid organization, Petrochemical Mutual Aid Organization (PMAO),
and has responded to other oil companies and chemical plants during emergencies.
Likewise, the emergency response resources of the other companies in PMAO are
available for an emergency at the Refinery, if needed.
Notification
The Emergency Response Program has plans and procedures in place for notifying
employees, onsite and off-site emergency responders, government agencies, the
community, and local hospitals in the event of a release. These procedures are given in
RI-434, Reporting Hazardous Spills and Releases, and are available on the Refinery
Information Server.
Upon the first detection of a release or other emergency situation, an employee is
required to call the central emergency phone number, which initiates the emergency
response. Alarms or sirens are used to notify personnel of an emergency situation, and
appropriate actions (e.g., shelter-in-place) would be taken according to the EAP.
The Refinery has an internal Refinery-wide alarm system consisting of multiple sirens
and loudspeakers to alert personnel to any incidents that may have impact on more than
CUSA 2013
3-28
February 2013
SITE SAFETY PLAN

14/2003 10:03:42 AM
one area of the facility. In addition, there is a dedicated emergency intercom system to
provide follow-up information during a widespread Refinery incident. Each operating
area of the Refinery has a local alarm system for incidents within their operating units.
Operators routinely carry in-plant two-way radios that are used for both normal and
emergency communications.
Employees who do not respond to an emergency and contractors are trained in the
Refinery EAP. Persons who are inside, or near, a building are instructed to shelter-inplace inside the building. Any individual who is not in, or near, a building are instructed
to proceed via a safe route to a designated assembly site. There are designated assembly
sites for both local area emergencies and for a Refinery-wide emergency. The senior
Refinery employee at any building or assembly site is responsible for collecting names of
the persons present and communicating them to the Plant Protection Dispatcher.
For hazardous material spills or releases with potential off-site impacts (or meeting other
reporting criteria), CCHMP, the Richmond Fire Department, and other agencies are
notified immediately. If appropriate, the CCHMP will activate the CWS to alert the
community. The CWS consists of several components as follows:
Sirens. Initially, four sirens may be activated by the Refinery to provide a loud
audible signal throughout the cities of Richmond and San Pablo. A total of 20
sirens are available and can be activated by CCHMP. See Figure 3-2. Upon
hearing the sirens, residents are advised to proceed indoors to shelter-in-place and
turn on their TV or radio to obtain further instructions or more information about
the incident;
Telephone Emergency Notification System. The TENS calls households and

businesses and transmits short messages about the incident and recommended
protective actions; and
Media. An initial warning, updates, instructions, and an all-clear is distributed

to the community through radio, television, and cable by CCHMP when there is
no longer a potential danger to the community.
CUSA 2013
3-29
February 2013
SITE SAFETY PLAN

CHEVRON RICHMOND REFINERY
14/2003 10:03:42 AM
Figure 3-2
Community Warning System Alert Siren Locations
Chevron 2012
3-30
February 2013
SITE SAFETY PLAN

LAST \
4.0
Human Factors Program

The Refinery is committed to applying a systematic approach to identify and resolve
human factors issues to prevent and reduce the possibility of accidental releases of
regulated substances that have the potential to cause significant harm to public health.
This section describes the various techniques the Refinery uses to meet the objectives of
the RISO and evaluate and minimize latent conditions that could result in a major
chemical accident or release. Below are the seven basic elements of the Human Factors
Program:
4.1
Employee Participation;
Training;
Process Hazards Analysis;
Operating Procedures;
Management of Organizational Changes;
Root Cause Analysis, and
Latent Conditions.
This section describes several examples of employee participation in the development
and implementation of the Refinerys Human Factors Program.
Development
A multi-discipline team was formed to ensure compliance with the RISO human factors
requirements, including members from Operations, Engineering, Learning &
Development, Projects, and a union HES representative. Due to the complexity of the
human factors elements, sub-teams were created and leaders assigned to manage the
development of the specific elements prescribed by the ordinance. The Refinerys PSM
Coordinator participated on all sub-teams to ensure consistency in program development.
Other employees participated based upon their subject matter expertise.
Some team members had prior training in human factors issues. Individuals assigned to
serve as human factors trainers attended a two-day Train-the-Trainer course presented by
the Labor Occupational Health Program (LOHP). LOHP assisted in the development of
both Human Factors Basic Awareness and CUSA-specific Human Factors Program
training.
Initially, over 1,350 employees and 100 contractors completed the Human Factors
Overview Training. Afterwards, participants were asked to assist in the development of
the Refinerys Human Factors Program by completing an anonymous on-line survey. The
purpose of the survey was two-fold: (1) provide the opportunity for each individual to
identify their top four latent condition concerns in their work area, e.g.,
Staffing/Overtime, Climate & Culture, Worker Selection, etc., and (2) identify specific
CUSA 2013
4-1
February 2013
SITE SAFETY PLAN

LAST \
latent conditions in their work areas that could result in incidents with significant human
consequences and/or a significant off-site impact.
All input into the development of the Human Factors Program was documented and
responses were communicated via various methods such as e-mail, web sites and face-to
face meetings. An internal web-site was also created to facilitate the communication of
additional concerns and submit comments or questions to the PSM Coordinator.
Questions were reviewed and responded to via the web-site. System-wide concerns and
comments were reviewed with and responded to by the appropriate employee and
management representatives.
Human Factors Committee - Ongoing Implementation
To ensure the on-going goals and objectives of the Human Factors Program are met and
sustained, a Human Factors Committee was developed. The Committee consists of
management, employees and their representatives who meet periodically and discuss
emerging human factor issues, suggest improvements, and verify program effectiveness.
All employees are encouraged to discuss their human factor concerns with any of the
Committee members, who will present those concerns to the full Committee and provide
individuals/groups with timely feedback. The Committees meeting minutes are retained
and available on the Refinerys shared file server.
The Human Factors Program is evaluated every two years by the process owner to
identify deficiencies and improvement opportunities. Proposed improvement plans will
be submitted to the Refinerys Health and Safety and Process Safety Management
Steering Committees for approval. In addition, the OE/PSM Manager will select
members of management and employees to annually review the work process to ensure
adequate support is given to sustain a successful program.
Employee participation in the implementation of Human Factors in other RISO elements
can be found in sections 4.2 to 4.7.
4.2
Human Factors Training

The success of the Human Factors Program relies heavily on employee involvement.
Therefore, employees must have a basic understanding of human factors concepts and
should also receive specialized training where applicable to ensure that they can fulfill
their specific responsibilities within the Program.
The objective of the Human Factors Training Plan is to instruct employees to be aware of
the different types of human error and recognize and understand underlying causes for
errors. Application of this knowledge can help prevent major chemical accidents or
releases. The Training Plan includes all current and new-hire full-time employees of the
Refinery.
The Human Factors Training Plan contains four elements:
CUSA 2013
Basic awareness training on human factors;

Training on the CUSA-specific Human Factors Program;
4-2
February 2013
SITE SAFETY PLAN

LAST \
Specialized training for individuals or teams; and

Refresher training.
Trainers are selected based on their subject matter expertise in the specific PSM areas or
Latent Conditions Checklist. They are trained to develop and deliver specialized training
to ensure that all employees can fulfill their specific responsibilities for implementing the
Human Factors Program. The expectations of trainers are as follows:
4.2.1
Attend two-day Train-the-Trainer class;

Participate in pilot class dry run; and
Deliver human factors training sessions for the Refinery.
Basic Awareness Training and Refinery-specific Human Factors Training
The RISO requires all employees to participate in a workshop that covers basic
awareness training in human factors and the Refinery Human Factors Program.
The training is provided in small group, instructor-lead sessions. Each session is
lead by a trainer who is qualified by completion of the LOHP two-day training
session in human factors.
The curriculum for the Refinerys basic awareness training consists of the
following types of information:
Lesson 1 An introduction to human factors;
Lesson 2 Finding solutions;
Lesson 3 Applying human factors to refineries; and
Lesson 4 The Refinerys Safety Plan.
Training methods in these lessons include classroom discussion, small group
exercises and evaluation to ensure that all trainees have an understanding of the
material. Many real life and work examples of human factors are included in the
curriculum. Specific learning objectives and detailed lesson plans ensure that
important concepts and major points of knowledge about human factors are
included in the training. Also included is an introduction to the use of the "Latent
Conditions Checklist."
Training in the Refinerys Human Factors Program is given to all full-time
employees. The curriculum includes a discussion of each element of the Human
Factors Program and who has overall responsibility for the Program and each of
its elements. Basic awareness training as well as training in the Human Factors
Program is combined in the same training sessions. The combined training is four
hours in duration. The trainers solicit feedback, require participation in small
group exercises, and question trainees for understanding throughout the training
program.
CUSA 2013
4-3
February 2013
SITE SAFETY PLAN

LAST \
4.2.2
Specialized Training
Employees receiving specialized training as part of the Human Factors Program
are those whose job responsibilities include:
Participation on PHA teams;

Root cause analysis;
Management of organizational change;
Procedure development;
Latent Conditions Checklist review; and
Inherently safer systems.
The curriculum for these specialized training sessions includes an orientation to

describe how the Human Factors Program incorporates human factors into
existing work processes and job specific information developed by subject matter
experts. Employees participating in completing the latent condition checklists,
conducting PHAs, developing operating procedures, and designing inherently
safer systems will receive training and orientation for elements specific to their
jobs. For example, employees responsible for developing operating procedures
will be trained on how to effectively incorporate human factors elements into the
procedure-writing process.
Various methods of evaluation are used to ensure participants understand the
information and training they receive in specialized training. These methods
include:
4.2.3
Trainee knowledge demonstrations with an instructor evaluation;

Written test with questions to verify understanding of the training; and
Small group activities presenting information learned back to the
instructors and the rest of the class to verify understanding.
Refresher Training
Refresher training for the employees who have already received Human Factors
Basic Awareness Training is delivered on a three-year cycle or more often, if
needed. Refresher training is an extension of the material provided in the initial
basic awareness training curriculum. It includes identifying latent conditions and
information the site-specific Human Factors Program. Final program elements
will be determined by consulting with the affected personnel and RISO core team
members to determine content. The current method of delivery is computer-based
training and compliance will be documented in the Refinerys training database.
Refresher training for employees who have received specialized training in human
factors will be provided on an as-needed basis. For those who have specific
responsibilities for implementing the Human Factors Program, there will be
refresher training available prior to each human factor activity (e.g., completion of
the Latent Conditions Checklist, incident investigation team members).
CUSA 2013
4-4
February 2013
SITE SAFETY PLAN

LAST \
4.3
Latent Conditions
Latent conditions are human factor issues that have not been resolved. These types of
conditions may exist in various areas of the Refinery and may lie unrecognized until
combining with active failures (an appropriate or inappropriate action) to result in an
incident. RI-384, Latent Conditions has been developed to define the latent condition
review process within the Refinery.
Latent conditions typically fall into four categories, which may involve the following
factors:
Individual: Experience/knowledge, Stress/Fatigue/Substance Abuse, and

Shiftwork.
NOTE: The scope of the Individual questions or indicators is limited to those
internal latent conditions that the facility can control.
Activity/Task: Procedures, Practices, Conflicts between procedures and practices.
Physical Environment/Workplace: Process Design and Labeling, Control
Room/Panel Design Hardware, Safeguards, Work environment.
Organization/Management: Communications, Training, Staffing/overtime,
Worker selection, Climate/culture, Management system.
When establishing the Human Factors Program, a list of 250 potential latent condition
questions prescribed by the CCHMP Guidance Document was reviewed by the Human
Factors Committee to determine how the questions should be applied. The results of this
activity generated the following three independent checklists used to address human
factors:
Refinery-Wide Latent Conditions Checklist - Questions on this checklist were

directed to management or refinery-wide efforts;
Plant-by-Plant Latent Conditions Checklist - Questions on this checklist were

reviewed in plants or areas within plants by the PHA Revalidation team; and
Procedures Latent Conditions Checklist - Questions on this checklist were

directed to address the inclusion of human factors as part of the procedures
improvement process.
Following several years of application of the latent condition checklists, the Human
Factors Committee initiated an effort to re-evaluate the checklist questions to ensure the
questions were still appropriate for their application and effective in identifying latent
conditions. In 2012, with the endorsement of Refinery leadership the latent condition
checklists were revised. Additionally, a fourth checklist was created to address human
factors at the Refinery business unit level. The following latent condition checklists have
been in effect since mid-year 2012:
CUSA 2013
4-5
February 2013
SITE SAFETY PLAN

LAST \
Refinery-Wide Latent Conditions Checklist - Questions on this checklist are

directed to management regarding Refinery-wide efforts. The Refinery-wide
review was performed initially in 2008 and will be performed on a 5 year cycle;
Refinery Business Unit Specific Latent Conditions Checklist - Questions on this

checklist are directed to management regarding Refinery business unit-specific
issues. The business unit-specific review will be initially performed in 2013 and
will be performed on a 5 year cycle;
Plant-by-Plant Latent Conditions Checklist - Questions on this checklist are

reviewed in plants or areas within plants by the PHA Revalidation Team. This
review is performed by a trained PHA facilitator at the beginning of each PHA
revalidation; and
Procedures Latent Conditions Checklist - Questions on this checklist are directed

to address the inclusion of human factors as part of the procedures improvement
process. This review is performed by trained personnel as each procedure is
updated.
The PSM Team Lead will ensure that Latent Conditions Checklists are reviewed every
three years to ensure the questions reflect the practices of the Refinery.
Latent Conditions are incorporated into the various human factors elements as described
in sections 4.4 through 4.7.
4.4
Process Hazards Analysis

In addition to the existing requirements of a PHA described in Section 3.11, the Refinery
has increased its existing human factors effort to include a specific latent condition
checklist review in conjunction with the PHA revalidation process.
The PHA Facilitator ensures the latent condition reviews are completed prior to the start
of the PHA node review. Any findings resulting from the review are discussed during the
PHA to address human factors requirements. These are reviewed to consider the effects
that the latent condition may have on the likelihood that an unsafe act, active failure, or
deviation should occur. Latent condition findings may also affect the adequacy of
safeguards identified during the HAZOP.
Latent condition findings are entered into a database and tracked to completion in the
same manner as PHA recommendations. Additional reviews may take place to determine
the magnitude of impact and whether a system-wide resolution or a local resolution is
appropriate to resolve the condition. Due dates and owners are assigned by the Refinery
Business Unit (for local issues) or resource owner (for system-wide issues). Periodic
reviews of unresolved action items are performed to ensure progress is being made.
CUSA 2013
4-6
February 2013
SITE SAFETY PLAN

LAST \
4.5
Root Cause Analysis

The Refinery conducts a root cause analysis for each incident that did or could reasonably
have resulted in a MCAR. The Refinery uses the TapRooT root cause analysis
investigation methodology to accomplish this.
TapRooT is a systematic method for determining the causal factors and seeks to answer
the basic questions about an incident, such as what happened, how did it happen, and why
did it happen. This methodology considers human systems during the fact gathering,
interviewing and analysis portions of the investigative process. Human systems are
defined as the systems (i.e., written and unwritten policies, procedures, and practices) in
effect to minimize the existence/persistence of human issues. Inadequate human systems
allow latent conditions to persist and cause or exacerbate an incident. Examples of human
systems include how the Refinery will use latent conditions and inherently safer systems
to prevent MCARs.
Facilitators of these investigations are provided training, including a comprehensive
study of the TapRooT methodology. The training also includes hands on development
of the Events and Causal Factors Flow Chart, the identification of the direct cause,
contributing cause, root cause, and barrier analysis. Human factors are addressed as
potential causal factors. The drafting of effective corrective actions, reporting
requirements, and report content completes the training curriculum.
An investigation analysis takes the time necessary to develop what happened and how it
happened, and then focuses on finding the underlying causes for why an incident
happened by determining the causal factors. There are three types of causal factors:
Direct causes These causes are the immediate events or conditions that caused
the incident. The direct cause addresses what happened;
Contributing causes These causes address how and why an incident happened.
Contributing causes are causal factors that are events or conditions that
collectively with other causes increase the likelihood of an incident but that
individually did not cause the incident; and
Root causes These causes answer the question of why an incident happened.
Root causes are the causal factors that, if corrected, would prevent recurrence of
the incident.
CCHMP has reviewed and endorsed the TapRooT investigation methodology as a

suitable substitute to address the latent condition requirements for MCAR Investigations;
per the CCHMP ISO Guidance Document.
When needed, a team of Refinery personnel is assembled to conduct a root cause
analysis. At least one member of the team is qualified as a TapRooT facilitator.
The team includes at least one person knowledgeable in the covered process involved,
and the rest of the team includes persons with appropriate knowledge and experience to
CUSA 2013
4-7
February 2013
SITE SAFETY PLAN

LAST \
thoroughly investigate and analyze the incident. The entire team is provided an overview
of the investigation methodology during the first team meeting.
The leader and the team are responsible to develop a final report containing the root
cause analysis, recommendations to be implemented to prevent the release or incident
from reoccurring, if any, and a schedule for completion of the resulting
recommendations. Report content may vary due to the severity and complexity of the
event. The following items are included in a report to the extent consistent with the
severity and complexity of an incident:
4.6
Table of contents;
Description of the incident, including on-site and off-site effects;
Brief description of the process involved;
Facts, including a time line of events;
Casual factor analysis, concluding with citing of the direct cause, contributing
causes and root causes;
Recommendations/corrective actions;
Schedule for implementing recommendations/corrective actions; and
Glossary, recognizing that the document will be in the public domain with nontechnical people reading it.
The Refinery EOM guidebook is the basis for all operating work instructions
(procedures, checklists and job aids) currently used in the Refinery. For each task,
identification is characterized and measured by the criticality of the task and the
frequency or complexity of performing the task. The final step of the front end analysis
phase was to develop written work instructions for the following:
Highly critical tasks;

When consequences of error are severe;
When the task being performed is complex;
When the task is infrequently performed and, therefore, more easily forgotten;
and
When the task requires the coordination of multiple operators/process units across
different sections or RBUs, and typically would be expected to last longer than
one shift.
To reduce the potential for human error, consistent formats were defined and applied to
written procedures within the Refinery. Employees responsible for developing and
maintaining the procedures are made aware of the principles for writing effective
operating procedures, which are detailed in the EOM Guidebook that is available on the
Refinery intranet. Each procedure is written to a level of detail suitable for a trained
operator responsible for performing the task. In addition all procedure writers have been
trained in Human Factors and Latent Conditions, including the use of a latent conditions
checklist.
CUSA 2013
4-8
February 2013
SITE SAFETY PLAN

LAST \
Work instruction formats are carefully structured to provide a trained operator the
information needed to do the job. The standard formats intentionally avoid including
unnecessary descriptive information within the work instruction.
Emergency procedures contain the approved procedures for responding to emergency
situations. These procedures are organized into standard groupings to take into account
the various types of emergency situations. Two separate procedure formats are used: a
summary procedure format and a detailed step format. The summary format appears as
the first page of each procedure, and the detailed steps immediately follow. For both
formats, the Emergency Procedure is divided into the following three parts:
Immediate actions;
Stabilizing actions, and
Exit actions.
Emergency procedures are color-coded to help identify who is responsible for performing
each task. EOM Guidebook describes in detail how to use the writing style and formats to
create Emergency Procedures.
Warnings and cautions identify the effects of procedural errors. Warnings state the hazard
and consequences of incorrect performance of a procedural step (or steps) where the
consequence may cause potential personnel injury. Cautions state the hazard and
consequences of incorrect performance of a procedural step (or steps) where the
consequence may cause potential equipment damage.
Additionally, the Consequence of Deviation Tables outline what will happen if plant
processes deviate outside their normal operating range. These tables include the probable
causes of such deviations and appropriate corrective actions.
The procedures are indexed and located on the Refinery intranet so they are easy to find
when needed. Having the procedures on the Refinery intranet ensures personnel have
access to current and approved versions of the procedures. Additionally, paper copies of
the Emergency Procedures are kept in the control rooms for easy reference in case of a
power outage.
Employees are trained in the importance of maintaining current and accurate procedures.
They also are trained that procedures are essential work documents and represent an
approved method for performing work. The procedures are written in such a manner so
the effects of procedural errors are highlighted, both in the steps required to perform a
task, and in the precautionary information included to show the consequences of
deviating from the procedure.
The Refinery makes use of the principles of good operating procedures and human
factors considerations during the review and revision of all procedures. In addition to the
EOM Guidebook, sources of guidance include the AIChE CCPS Guidelines for Writing
CUSA 2013
4-9
February 2013
SITE SAFETY PLAN

LAST \
Effective Operating and Maintenance Procedures (1996) and the CCHMP Human
Factors Program Guidance Document (1999). As part of its preparation for
implementation of the RISO, the Refinery conducted an assessment of its operating
procedures and prepared a work plan to correct deficiencies.
Procedures are updated on a continual, as needed, basis through the Refinery MOC
process. To ensure the most recent document is being updated, documents must be
checked out through a Document Administrator. There is a revision record at the end of
each document. The intent of the revision record is to track all changes that have been
made to a document. The revision record shows the date of the revision, section, MOC
number, and a brief narrative describing the change. Operating procedures are certified as
current and accurate on an annual basis.
As part of the initial implementation of the RISO, a procedures team performed a review
to specifically examine any differences between the RISO requirements and the
Refinerys operating procedures. Each plant operating manual was examined. The
decision was made to concentrate on start-up, shutdown, and emergency operating
procedures, since incorrect performance or inaccuracies of these types of procedures is
most likely to result in a MCAR. Of the procedures available, a representative sample of
5%, or approximately 200 procedures were reviewed in detail.
The review team employees have had extensive operating experience and experience
with the development of Refinerys current generation of operating manuals and
procedures. The group broke up into two sub teams to facilitate their work and examined
operating procedures using questions from the RISO audit protocol as a guidance
checklist. The audit protocol (in combination with the EOM Guidebook standards) was
found to be equivalent to using the CCHMP Latent Conditions Checklist. Each procedure
examined, and any deficiencies found, was recorded. Following this process, the review
team met to discuss their findings and made recommendations to the Refinerys RISO
core team. The team developed and executed a plan to meet all requirements for all
operating procedures for covered processes.
The Refinery is currently completing a reassessment of all operating job tasks as part of a
multi-year project to ensure that the written instructions contain the appropriate level of
detail based on the criticality, complexity and frequency of the task.
4.7
Management of Organizational Changes

The purpose of the Refinerys Management of Organizational Change (MOOC) policy is
to ensure proper management of an organizational change that could potentially impact
the health and safety of workers, the community, and the environment. Proper
management of organizational changes can ensure critical process safety tasks are
accounted for. These changes are reviewed and implemented prior to the change to
ensure the critical process safety tasks continue to be executed with quality. The Refinery
has a written instruction, RI-382 Management of Organizational Changes, that
establishes the procedure for managing organizational changes.
CUSA 2013
4-10
February 2013
SITE SAFETY PLAN

LAST \
When considering organizational changes, organization charts and key job

responsibilities related to health, safety and emergency response may be considered to
assist in the determination whether or not the MOOC process will be utilized. The
manager of the affected work group is responsible for identifying changes that require
screening, and the OE/PSM Manager is responsible for screening organizational changes
to determine when a management of organizational change review (MOOC Review) is
required. A MOOC screening is performed to determine if a full MOOC Review will be
required in each of the following three situations:
1. Increases or decreases in the number of positions;
2. A substantive increase in the duties of positions; and
3. Reorganization of a department or substantive changes in the responsibilities of
positions.
Positions affected by this policy include the following:
1. Operations positions including supervisor and engineering positions with direct
operations responsibilities;
2. Emergency response positions;
3. Maintenance positions;
4. Health and safety positions; and
5. Permanent operations or maintenance contractor positions where the Refinery
controls the number of permanent contractors.
When the screening determines that a MOOC Review is required, a MOOC team is
formed. The size and makeup of the team should be appropriate, including Engineering,
Maintenance, Operations, as well as Health & Safety representatives, for the type and
complexity of the change. Employees and their representatives shall be part of MOOC
teams that are evaluating represented positions. Before beginning a MOOC Review,
MOOC Team members receive training and are required to read relevant documents and
forms provided by the Health, Environment and Safety Department. Relevant documents
will include the Refinery Instruction and the Contra Costa County Health Services Safety
Program Guidance, Section B, Chapter 7.
Once trained on the MOOC Review process, the MOOC team determines the technical
basis for the change (including the purpose, scope, and schedule of the proposed change)
and potentially affected jobs/positions, and work groups and/or organizations. The
MOOC team will assess potential impacts of the proposed change on safe work practices
and emergency response, and will identify action items that, if completed, would mitigate
and/or eliminate the potential adverse impacts of the proposed change on safe work
practices and emergency response.
Input from potentially affected employees is solicited by distributing information about
the proposed change to such individuals, and by requesting their written health and safety
concerns and action items that could mitigate and/or eliminate the potential adverse
impacts of the proposed change on safe work practices and emergency response.
CUSA 2013
4-11
February 2013
SITE SAFETY PLAN

LAST \
Once this process is completed, the OE/PSM Manager (or delegate) and the MOOC
Facilitator meets with senior management of the organization(s) to be affected by the
proposed change to discuss the findings and recommended action items resulting from
the MOOC Review process. Senior management determines which action items are
necessary to ensure process safety continues to be sustained.
Before the proposed change is implemented, the MOOC Facilitator reviews and signs off
that required action items have been completed, (including any procedures - operations,
maintenance, HES - that need updating as a result of the change), the Change Manager
conducts a preimplementation review and verifies action items are complete, and a
member of senior management of the organization(s) to be affected by the proposed
change authorizes implementation of the change.
Employees trained in the change are given instructions for providing feedback to the
MOOC team on any issues, concerns or recommendations pertaining to the change
(including impacts of the change). The Change Manager is responsible for reviewing this
employee feedback, and for periodically discussing it with senior management who will
determine what additional action items, if any, are to be completed.
After the change has been implemented, the Change Manager consults with employees of
the affected work group(s)/organization(s) to identify any outstanding issues or concerns
relative to safe work practices and emergency response and their recommended action
items. This consultation also includes determining if the change has created any
additional issues, concerns, or recommendations. The Change Manager is responsible for
discussing this feedback with OE/PSM management who will determine what additional
action items, if any, are to be completed. Feedback is provided to the employees who
suggested changes, including communicating the disposition of their recommendations.
Since 2009, new MOOC records have been tracked electronically.
CUSA 2013
4-12
February 2013
SITE SAFETY PLAN

5.0
Accident History
Since 1992 seventeen (17) incidents have been reported to CCHMP that meet the
definition of a Level 2 CWS, Level 3 CWS, or Major Chemical Accident or Release.
Included is a brief description of these events using the available documentation.
All corrective actions from each event have been fully implemented unless indicated
otherwise.
The following is the required reporting accident history for the Refinery:
6/23/92: The refinery had limited steam available to do planned work on the steam
system. The boiler feedwater pump to the CO Boiler tripped resulting in a low drum level
in the Boiler. The Boiler was shut down to prevent major equipment damage; this
resulted in an additional loss of steam production. Loss of steam pressure caused the
(steam driven) main air compressor to shutdown. Once the main air compressor stopped,
it began to rotate backwards, which resulted in low air pressure. The low air pressure
caused the FCC feed valve to close (normal condition on loss of air). The subsequent
restart of equipment led to the stack producing visible un-burnt hydrocarbons and odors.
Shelter in place was issued to the community and several areas of the refinery. There
were approximately 50 calls from residents and the event received media attention.
All of the appropriate agencies were notified in a timely fashion. Wind direction was out
of the northwest at 112 at approximately 12 mph (away from residences). There were no
reports of on site or off-site illness or injury associated with this event.
2/10/94: A breaker in the electrical system opened up due to a raccoon coming in contact
with two phases of the 12kV system. Many areas of the Refinery were affected with
emergency flares and stand-by equipment being activated. Wind direction was primarily
from the south west at 216 at approximately 10 mph. A H2S excess and SO2 release
occurred. This event raised community and a neighboring business concerns.
10/20/95: While evacuating a line of sulfuric acid, a flange was spread to let it drain into
a drip bucket. When a bleeder was opened, acid shot out of the top part of flange,
spraying an employee down the neck, in between his acid suit and hard hat.
As a result of this incident, there was one recordable injury to an employee involving a
regulated substance.
8/10/96: A western states power outage occurred on the PG&E electrical system. The low
frequency of the system caused the Refinery to separate from the normal utility provider.
The Refinery system could not meet the electrical demands of the Refinery, ultimately
resulting in a refinery-wide shutdown and heavy black smoke from the refinery
emergency relief flares. Wind direction was from the South east at 169 at 15 mph.
CUSA 2013
5-1
February 2013
SITE SAFETY PLAN

4/13/97: At approximately 3:45 P.M., a section of 2 diameter piping failed in the high
pressure separation section of the Heavy Neutral Hydrocracker. The pipe failed by tensile
overload (over pressuring) where ammonium bisulfide corrosion had thinned the carbon
steel piping below minimum thickness. The root cause was that the original plant design
did not address high-velocity areas in the piping when the Power Recovery Turbine
(PRT) is bypassed. To prevent this event from reoccurring, the Refinery took action to
ensure that current design specification for power recovery turbine systems addresses the
concern of high velocities in the bypass piping and the possibility of corrosive stock
being present due to poor water/oil separation. In connection with this incident, the
Refinery reported H2S release to BAAQMD, and all other appropriate agencies were
notified in a timely fashion. There were no reports of illness or injury associated with this
event.
Wind direction was west-southwest between 2:00 P.M. to 4:00 PM on the day of the
incident. Wind speed averaged approximately 12 mph.
9/21/97: At approximately 10:25 A.M., the SRU experienced a failure in the
Uninterruptible Power Supply (UPS). Power was restored by 11:03 A.M., and operations
proceeded to start-up. During the start-up, SO2 breakthrough occurred. The Refinery
reported SO2 excess emissions of 301 ppm, and H2S in the fuel gas of 170.40 ppm to
BAAQMD, and all other appropriate agencies were notified in a timely fashion. There
were no reports of illness or injury associated with this event.
To prevent this event from reoccurring, the UPS control module and power supply
module were replaced. I&E Mechanics reviewed the UPS system control logic, and the
SRU Section Trainer reviewed UPS system with SRU Operators.
Wind direction was to the south between 10:00 A.M. to 1:00 P.M on the day of the
2/14/98: Contractor insulators working in the vacuum furnace area reported an oil leak to
plant operations. The plant operator identified a leak coming from an FT1160-3 pass flow
orifice root valve. The orifice lead came loose and sprayed hot crude on three contract
insulators, causing minor burns. The hot oil ignited in the area of the leak resulting in fire
at F-1160. Furnace burner fires were pulled and a plant shut down was initiated. Division
First Response team members isolated the leak, and then plant operators and Refinery
Plant Protection extinguished the fire. The leak, personnel exposures and subsequent fire
was a result of an instrument tubing failure on a pass flow on F-1160. It was discovered
that the stainless steel tubing on the pass flow had external damage and was the main
cause of the release and fire.
This incident resulted in over $500,000 in equipment damage and three contractors
received first aid. All of the appropriate agencies were notified in a timely fashion. CUSA
is unable to retrieve accurate weather data due to data retention difficulties.
CUSA 2013
5-2
February 2013
SITE SAFETY PLAN

3/25/99: At approximately 2:25 P.M., a release of flammable vapor occurred from a
valve in the Isomax Plant at the Refinery. Approximately three minutes after the release
started, the vapor ignited resulting in a fire in the area of the Isomax reactor feed pumps.
The fire was brought under control by 6:00 P.M. and an all clear was issued at 8:30 p.m.
A controlled fire to allow any vented vapors to be safely burned continued until Saturday,
March 27, 1999. This was a Level 3 CWS event. All of the appropriate agencies were
notified in a timely fashion.
The physical evidence indicated that the valve was over pressured. The source of ignition
is not known.
To prevent this event from reoccurring, the WKM Model D Pow-R-Seal valves in the
Refinery were replaced with a valve of a different design that is suitable for the service in
which it is used and is installed in accordance with the manufacturers instructions and
the Refinerys safety, operability, and environmental standards.
The total quantities released represent the sum of the RQ emission over the duration of
this event under the assigned SOES Control Number. This event resulted in of 18,000
pounds of SO2 emissions, and 16 pounds of H2S emissions.
Wind direction was west-southwest between 2:00 PM and 8:00 PM on the day of the
As a result of this event, there were 8 OSHA recordable injuries, and 5 non-OSHA
recordable injuries.
6/1/99: At approximately 2:40 A.M., the gas recovery unit (GRU) in RLOP experienced
intermittent lifting of a pressure relief valve which resulted in venting of gas to the RLOP
safety flare. This was caused by plugging of the GRU compressors discharge cooler. The
pressure relief valve acted per design and prevented equipment damage. The relief gasses
contained small amounts of H2S, which when combusted in the RLOP safety flare formed
SO2.
To prevent this event from reoccurring, the CUSA completed the following corrective
actions:
Performed a service and design review of pressure transmitter PT19301 for

suitability/reliability; and
Established a trip point for the E-1900/E-1901 low outlet temperature alarm.
The Refinery reported the release of 1,147 pounds of SO2 to BAAQMD, and all other
appropriate agencies were notified in a timely fashion.
Wind direction was west-southwest between 2:00 AM and 7:00 AM on the day of the
CUSA 2013
5-3
February 2013
SITE SAFETY PLAN

As a result of this event, there was 1 OSHA recordable injury, and 3 non-OSHA
recordable injuries.
11/23/01: At approximately at 7:45 P.M., Plant Protection noticed smoke rising from the
Wax RBU. Pump J-25s insulation, which was soaked with wax, caught on fire. The
steam tracing was in service, and ignited the fuel source.
All of the appropriate agencies were notified in a timely fashion.
Wind direction was east-southeast between 2:00 PM and 4:00 PM. Wind speed averaged
approximately 12 mph.
There were no reports of illness or injury associated with this event.
11/27/01: The HNC #15 plant experienced a fire at control valve 85FV173. RI-9900 was
not followed which allowed hydrocarbon to escape to the atmosphere. Maintenance had
completed work on control valve 85FV173. They found a loose coupling on the valve
stem actuator. Repairs were made and the control valve was turned over to operations for
return to service. On November 27, 2001 the AM operations returned the control valve to
service. A bleeder valve was left in the open position, resulting in a release of
hydrocarbon and fire.
This event could have resulted in a major fire, which could have led to a catastrophic
release, personal injury and environmental penalties.
Wind direction was from the north between 6:00 AM and 07:00 AM on the day of the
As a result of this event, there were no OSHA Recordable, and 1 non-OSHA Recordable
injury.
1/31/02: 1At approximately 2:07 PM, a release occurred following a process upset in the
No. 4 H2S sour gas plant in the Isomax RBU. This upset caused the #3 SRU in the
Cracking RBU to shut down. These events caused process gases to be routed to the SRU
stack and safety flare systems in the Isomax and Distillation and Reforming ABUs. When
combusted, the gases in the flare formed NO2 and SO, resulting in RQ releases for both.
Two Refinery operators in the SRU were exposed to H2S and natural gas during the
restart of #3 SRU. Refinery EMTs responded to this event. Both operators returned to
work immediately.
The CUSA Gertrude St. weather station records indicate the wind was predominately
from the north (340 degrees) to south (160 degrees) on the day of the incident, with wind
CUSA 2013
5-4
February 2013
SITE SAFETY PLAN

speeds from 7 to 10 mph. This event resulted in emissions of 1,591 pounds of Nitric
Oxide and 32.9 pounds of Sulfur Dioxide.
To prevent this incident from reoccurring, routine backwashing was stopped and will
only occur when exchanger performance dictates. The exchanger performance will be
monitored daily by operations through the use of our critical reliability variables. There is
one variable set up to record the difference between the hydrocarbon liquid and gas. If the
temperature difference decreases, the exchanger is beginning to foul and should be
backwashed. The exchanger performance will also be monitored monthly by Nalco.
In the event that the Refinery needs to backwash, a procedure specific to E-1020 has been
developed. The procedure is written so that in setting up for a backwash, the exchanger is
always pressured and packed with the supply water. The flow will be stopped shortly, but
the exchanger cannot be partially drained. The procedure will also specify to backwash
until the E-1020 process outlet temperature returns to normal prior to stopping the
backwash and returning to normal flow.
10/21/02: At approximately 6:00 AM, the Refinery experienced three 115 kV flashovers
at Standard Oil Switching Station (SOSS) Bus 2. The flashovers created an upset
condition in the high voltage electrical system. U&E personnel removed Bus 2 from
service to prevent further bouncing of the electrical grid. Bus 1 remained in service, and
115kV power was still being supplied by Cogen and PG&E. The Refinery still had
adequate electrical power and steam at this time. At approximately 7:10 AM, a single
flashover occurred on Bus 1 at SOSS. As a result, six circuit breakers opened and
electrical power was lost from both Cogen units, as well as electrical supply to Sub 1 and
Sub 3. Both Cogen turbines tripped on flame-out causing a high pressure steam
shortage throughout the Refinery. Concurrently, the RLOP Feeder also tripped causing
FCC to shutdown. Sub 2 and Sub 4 continued to supply PG&E power to a portion of the
Refinery during the entire event.
This was a Level 2 CWS Event. Ground Level Monitoring indicated no detectable
readings of materials normally measured. Personnel performed perimeter monitoring at 8
locations. Bag samples and direct readings were recorded. Readings for H2S, NH3, LEL,
and VOC: all results were all 0. SO2 and NO2 readings were also taken. All results were
less than 0.4 ppm and 0.5 ppm, respectively.
The following total quantities released represent the sum of the RQ emission over the
duration of this event under the assigned SOES Control Number:
NO Emissions
SO2 Emissions
H2S Emissions
1,006 pounds
79,340 pounds
238.4 pounds
CUSA 2013
5-5
February 2013
SITE SAFETY PLAN

Wind direction was traveling from east (78 to124 degrees) to west (258 to 304 degrees).
Wind speeds 2 to 5 MPH. Temperatures were averaging between 50 to 56. Heavy fog
was increasing onshore and restricted visibility to less than 100 feet in many areas of the
Refinery. There were no on-site or off-site injuries reported.
During the investigation, chemical analysis and testing of the failed insulators revealed
the presence of gypsum, when combined with the heavy fog conditions present on
10/21/02, created an electrical path to initiate the flashover which triggered the
subsequent events. Gypsum is an ionic compound having greatly higher electrical
conductivity than routine soil-derived dust.
Refinery guidelines were not in place to address storage of gypsum or other dust creating
compounds near high-voltage equipment.
Information regarding the subsequent steam outage has identified that the Cogen
automatic NOx steam valve curve was too slow. As the Cogen turbines moved into
automatic electrical load-shed, the NOx steam extinguished the burners as the natural gas
valve closed, thus shutting-down both Cogen turbines.
To prevent this incident from reoccurring, the following corrective actions are complete:
Water wash and powder blast 115 kV insulators;

Issue sustainable guidance to Refining on controlling the threat of dirt dust in
proximity to high voltage equipment;
Issue guidelines concerning the storage, placement, and movement of gypsum
and/or other dust generating matter in the vicinity of high voltage equipment;
Remap the NOX steam valve curve to reduce steam flow at lower MW; and
Performed design review of SOSS 115kV protective systems;
Added new circuit breaker to isolate the RLOP feeder.
8/9/03: K-600 shut down on low lube oil pressure. The main lube oil pump, TP-603A,
shutdown and would not restart due to a seized bushing. Operators attempted several
restarts of K-600 but were unsuccessful. Agency notifications were made for the
shutdown of K-600 beginning at 2:37 p.m. K-600 was restarted at 6:00 p.m., and at 6:45
p.m. operators shut down K-600 due to an inability to maintain seal oil flow. Operators
then began to de-pressure the system to reduce reactor bed temperatures. Bed
temperatures remained high, and at 7:11 p.m., operators opened the emergency depressure valves and North Isomax was taken off of Flare Gas Recovery. Due to flare
activity with visible smoke, operators maximized steam flow to the flare. At this time, the
flare was unstable with incomplete combustion. After approximately 10 minutes, the flare
operation stabilized.
Agency notifications were made for the flaring associated with the reactor
depressurization beginning at 7:16 p.m. Community impact was first observed at 7:37
CUSA 2013
5-6
February 2013
SITE SAFETY PLAN

p.m., when Plant Protection confirmed an odor complaint from the guard at CUSAs
Hensley Street facility.
The Refinery Shift Coordinator activated the CWS, Level 1 at 7:52 p.m. Unified
Command (Richmond Fire Department and the Refinerys Emergency Response
organization) was established at Richmond Fire Department, Station #62. A total of 43
hand-held analyzer samples were taken, with below detection level results. Seven bag
samples were sent to an outside lab for analysis. Only one of the bag samples showed a
positive result, 0.1 ppm for H2S. All other samples were below detection levels. At 9:19
p.m., RFD called CCHS to activate the CWS, Level 3, as a result of multiple agencies
receiving odor complaints. At 11:09 p.m., CCHS sounded the All Clear. On site impact
was minimized, however, we did experience flare activity.
The following total quantities released represent the sum of the RQ emission over the
duration of this event under the assigned SOES Control Number:
Number of days an RQ was reached in a 24

hour period as a result of this incident
Total pounds released
NO
0
SO2
1
H2S
0
791
EMERGENCY RESPONSE ACTIONS:

Refinery personnel began monitoring the community at 7:37 p.m., conducting 48 air
monitoring analyses. The Refinery Shift Coordinator activated the Community Warning
System, Level 1 at 7:52 p.m. Unified Command was established at Richmond Fire
Department, Station 62.
METEROLOGICAL CONDITIONS AT TIME OF EVENT:
Wind direction: from the West/Northwest (280 to 300 degrees) and from the
East/Southeast (105 to 120 degrees) on the day of the incident. Wind speed averaged 12
to 15 mph. The air temperature decreased from 75F to 64F.
DESCRIPTION OF INJURIES:
There were no on-site or off-site injuries.
COMMUNITY IMPACT:
Emergency response was focused on internal and community monitoring. The Refinery
conducted 48 field tests. Testing was conducted in conjunction with the Richmond Fire
Department. Readings for H2S, NH3, LEL, SO2, NO2, and VOC were below detection
levels with the exception of one bag sample which recorded 0.1 ppm of H2S.
CUSA 2013
5-7
February 2013
SITE SAFETY PLAN

1/15/07 - #4 Crude Unit Fire
The refinery crude unit was being prepared for scheduled maintenance. As pump P1165A was started, a release occurred from a swing out wash oil pipe spool when a
section of that spool failed. The material released was a mixture of wash oil1, and
partially processed crude oil. Within several seconds, at 05:18 AM, the mixture ignited
resulting in first aid burns to an operator. Due to the fires potential off-site impact, the
Refinery initiated a Contra Costa Health Services (CCHS) Community Warning System
(CWS) Level 2 notification at 05:22 AM. Shortly thereafter, at 05:30 AM, a CWS Level
3 was issued to portions of the community alerting people to shelter in place. The main
fire was extinguished at 07:00 AM and CCHS announced the CWS all clear at 8:40 AM.
For safety reasons (to not accumulate quantities of unburned vapor) several small fires
were allowed to continue in a controlled manner until 14:14 PM on the same day.
Causes
Primary Cause: Per original plant design the pipe spool for connecting wash oil to the
discharge of the pump is a swing out type, which was not intended to be connected to the
pump discharge line during normal operation. Instead, the spool was connected to the
discharge of the pump for an extended period of time. Leaving the swing out wash oil
pipe spool connected to the discharge of the pump allowed the spool to be exposed to
process conditions. Metallurgical testing and analysis indicate that the failed section of
the spool was thinned by high temperature sulfidation corrosion.
Contributing Cause: The gate valve off P-1165A discharge line was missing its valve
seats. The pump startup allowed full pump discharge pressure to enter and rupture the
thinned section of the spool. While modeling did not show that the missing seats alone
caused corrosion to occur, the missing seats are believed to have contributed to process
conditions that allowed sulfidation corrosion and thinning of the spool to occur.
Root Causes (as defined in the Tap RooT methodology) & Corrective Actions:
Causal Factor No. 1: Swing out wash oil spool connected to the discharge of pump P1165A was connected for a lengthy period of time (20+ years).
Background: Swing out wash oil spool was left connected to plant pipe without going
through a thorough evaluation utilizing a formal Management of Change process prior to
updating plant Piping and Instrumentation Diagrams (P&IDs).
Root Cause: Management System Standards, Policies or Administrative Controls
(SPAC) Confusing or Incomplete.
Wash oil is basically diesel fuel that is used to remove heavier crude oil residue from the internals of
equipment in preparation for equipment clean-up and maintenance.
CUSA 2013
5-8
February 2013
SITE SAFETY PLAN

Note: Confusing or incomplete infers the existing SPAC (procedures), used at that
time, did not fully address/specify what actions/steps were needed at the time changes to
this equipment configuration took place.
Corrective Actions & Status:
1.
Determine the integrity of the swing out wash oil spools at all hot oil pumps in the
Crude Unit and repair or replace as necessary. Utilizing the MOC process, change the
design for permanent installation of the spools or implement operating procedures to
ensure those spools at all hot oil pumps in the Crude Unit are disconnected or blinded at
the first block valve off the pump during normal unit operation. Ensure the plant P&IDs
reflect this design. Richmond implemented the Inherently Safer Solution: Upgraded wash
oil pipe spool metallurgy/design in the Crude Unit for permanent installation, eliminating
the potential for sulfidation corrosion.
Status: Complete
2.
It is believed that the change in operation of the spool occurred before the
Refinery instituted a more rigorous Management of Change (MOC) process in 1993 to
ensure that changes (other than in-kind) are evaluated and approved prior to
implementation of such changes in the field. The MOC process would have identified the
implications of the technical and health and safety impacts of this type of change.
Status: Complete.
3.
Reinforce that field conditions which are found that do not match existing P&IDs
use the MOC process to verify P&ID changes are fully evaluated prior to changing such
documentation.
Status: Complete
4.
Send communication to CUSA Global Refining Operations and Reliability
Managers to evaluate metallurgical specification breaks at all hot oil (>475 F) pumps,
with emphasis on positive isolation at specification break points.
Status: Complete
5.
Identify (refinery wide) existing swing out spools and verify they are still being
operated as such, or ensure a proper design review has been conducted for changed
operation.
Status: Complete
Causal Factor No. 2: Seats missing in the 4-inch 5 Chrome gate valve at the wash oil
connection point off of the discharge of P-1165A.
Background: The Richmond Refinery was not able to determine if the valve was received
from the manufacturer with missing seats, or if repairs were made to the valve and the
seats were not reinstalled.
Root Cause:
CUSA 2013
Manufacturing or Quality Control: Unable to Determine.
5-9
February 2013
SITE SAFETY PLAN

Note: The TapRooT process specifies unable to determine if the root cause is not
conclusive. Below, CUSA has identified corrective actions that would prevent a
recurrence if the basic cause was either manufacturing or quality control related.
Corrective Actions & Status:
1.
Replace the valve on P-1165A discharge piping to wash oil pipe spool.
Status: Complete.
2.
CUSA Global Procurement to ensure contract language requires valve suppliers to
administer quality control checks for proper assembly of new valves and that procedures
include a seat tightness hydrotest for all existing valves undergoing repairs by third party
valve repair shops. This applies to existing and new contracts.
Status: Complete
3.
Richmond Refinery Machine Shop to ensure their procedure includes a seat
tightness hydrotest for all valves undergoing trim modifications or repairs by the Refinery
machine shop.
Status: Complete
4.
Communicate the recommendation that all CUSA Refining machine shops ensure
procedures include a seat tightness hydrotest for all valves undergoing trim modifications
or repairs by the Refinery machine shops.
Status: Complete
Date & Time Event Began: Monday, January 15, 2007, 05:18AM
Date & Time Safe and Controlled Conditions Were Established: Fire under control and
CCHS Community Warning System all clear sounded at 08:40AM, January 15, 2007
(controlled burning of several small leaks remained to prevent accumulation of
flammable vapors). All fires extinguished January 15, 2007, 14:14PM
Date & Time Investigation Started: January 15, 2007, 07:00AM.
Type of Incident: CWS Level 3
Cost of Incident: Greater than $500,000
Chemicals released: The Comprehensive Environmental Response, Compensation, and
Liability Act (CERCLA) and the Emergency Planning and Community Right-To-Know
Act (EPCRA) require reporting when a facility releases more than a reportable
quantity of a hazardous substance. The reportable release thresholds are based upon
EPCRA & CERCLA reporting requirements. No materials released exceeded these
reporting thresholds. Final calculations of the total materials released are noted below,
which are a result of the materials combusted during the fire:
Material Released
Sulfur Dioxide (SO2)
Nitric Oxides (NOx)
Sulfuric Acid (H2SO4)
Hydrogen Sulfide (H2S)
CUSA 2013
Quantity Released
377 pounds
34 pounds
6 pounds
2 pounds
5-10
CAS Number
7446-09-5
10102-43-9
7664-93-9
7783-06-4
MSDS Number
CVX - 584
CVX -11185
GC-V01011
CVX - 301
February 2013
SITE SAFETY PLAN

Weather Conditions:
Wind Speed
Wind Direction
Precipitation
Temperature (F)
Stability Class
8 MPH
75 (E
to W)
None
43
E
On Site Emergency Response:
The Refinery Fire Department was notified approximately 05:20 AM.
Plant Operators activated deluge system in the Crude Unit and applied water
from fixed ground fire water monitors.
Refinery Fire Department personnel arrived on scene at approximately 05:22

AM; ultimately 2 ladder trucks, 3 engine pumper trucks, and one Refinery emergency
response unit applied approximately 6,000 GPM of fire water from mobile mounted
high volume fire water monitors. An additional 2,000 GPM was being applied using
fire water attack hoses. An estimated 2500 gallons of 1% foam concentrate was applied
to the fire. The fire water demand rate dropped off significantly after approximately
07:00 AM.
Responding organizations included the Refinery Fire Department, Refinery Fire

Brigade members and Richmond and El Cerrito Fire Departments. Petro-Chemical
mutual aid was provided by Valero, Shell, Tesoro and Dow.
A total of five (5) alarms were dispatched in response to this event and the
Community Warning System was activated at Level 3.
Off-Site Emergency Response: Four (4) CUSA employees were immediately deployed
outside of the refinery to manually take air monitoring samples at various locations
downwind of the fire using direct-reading instrumentation. The manual monitoring
continued throughout the incident.
On-Site Impact: Non-essential personnel were evacuated from the D&R area then
sheltered-in-place. A Refinery-wide and Energy Technology Center shelter in place also
occurred. One employee was treated for minor burns by the Refinery Fire Department
and an outside hospital. That employee was released to return to work on the same day.
Another employee received on-site treatment for a minor skin irritation and returned to
work on the same day.
Off-Site Impact:
1.
The Richmond Refinery activated a Level 2 and Level 3 notifications via the
Contra Costa County Community Warning System.
2.
On the day of the incident, CUSA received eleven (11) calls from the public.
3.
Fence line monitoring:
The Refinery utilized the BAAQMD required continuous monitoring data from
instrumentation located at the Refinerys High Hill, Office Hill and Gertrude Street
CUSA 2013
5-11
February 2013
SITE SAFETY PLAN

monitoring stations. Data points are given close to or prior to the incident as a reference.
The following maximum readings were recorded between the times the fire started and
the time all-clear was called by CCHS. All readings were well below: (1) Reportable
release thresholds, (2) Cal/OSHAs Permissible Exposure Limits (PELs) and (3)
California OEHHA/ARB chronic inhalation Reference Exposure Levels (RELs).
Therefore, emissions from the incident were well under both worker and community
health exposure limits.
High Hill
Office Hill
Gertrude
Street
H2S
4 ppb @ 05:18
2 ppb@ 05:18
H2S
56 ppb @ 06:39
SO2
Station does not

monitor
3.5 ppb @
07:30
Non-detectable
- <1 ppb
1 ppb @
05:18
2 ppb @
07:37
Nondetectable <1 ppb
OSHA 8
hour limit
(PEL)
10,000 ppb
Chronic
REL
10,000 ppb
400 ppb
2,000 ppb
4 ppb
400 ppb
Note: The Cal/OSHA 8 hour PEL for SO2 is 2,000 ppb (2 ppm) averaged over an 8-hour
period. The Cal/OSHA PEL for H2S is 10,000 ppb (10 ppm) averaged over an 8-hour
period.
Sampling data and community monitoring results:
All air samples taken during the incident indicate there was no evidence of adverse air
quality, and hence, we would not expect adverse health impacts to have resulted from the
incident. All sulfur and VOC compound analytical results were below: (1) Reportable
release thresholds, (2) Cal/OSHAs Permissible Exposure Limits (PELs) 1, and (3)
California OEHHA/ARB chronic inhalation Reference Exposure Levels (RELs) 2.
Therefore, emissions from the incident were well under both worker and community
health exposure limits.
All 31 direct-reading samples showed non-detectable concentrations of Hydrogen Sulfide
(H2S), < 0.1 ppm. Sulfur Dioxide (SO2), < 0.1 ppm, and benzene < 0.1 ppm.
Testing for sulfur was performed using ASTMD-5504 method testing for 20 sulfur
compounds. Only one compound, Carbonyl Sulfide was found above the detection limit2.
The lab indicated interference from the Tedlar bags may contribute, in whole or in part,
to the positive results of Carbonyl Sulfide. Testing for Volatile Organic Compounds
(VOCs) was performed using EPA method TO-14A GC/MS Full Scan for 62 VOC
compounds. Only five (5) compounds were detected above the detection limits.
NOTES:
The detection limit refers to the minimum level which the testing instrument is capable of reading.
CUSA 2013
5-12
February 2013
SITE SAFETY PLAN

1
OSHA sets enforceable permissible exposure limits (PELs) to protect workers against
the health effects of exposure to hazardous substances. PELs are regulatory limits on the
amount or concentration of a substance in the air.
2
The California Office of Environmental Health Hazard Assessment (OEHHA) Chronic

Reference Exposure Limits (RELs) set airborne levels that would pose no significant
health risk to individuals exposed continuously to that level. These limits are set to
protect people living in communities surrounding such releases.
CCHS Monitoring:
In addition to the sampling and monitoring conducted by the Refinery, CCHS gathered 3
ambient air samples during the incident and had them analyzed for VOCs. All results
were characterized as at or near typical background levels.
Agencies Notified, including time of Notifications:
Primary: Community Warning System (CWS):
a. Level 2 activated by the Richmond Refinery at 05:22 hrs
b. Level 3, sirens activated by the Richmond Refinery at 05:30 hrs
c. All-clear issued by CCHS via CWS at 08:40 hrs
Secondary: Additional notifications via telephone to the agencies below and others
The list below does not include all representatives from the respective agencies:
Cal/OSHA Inspector
RPD Chief
RFD Chief
CCHS HazMat Pgm. Asst. Director
ECFD Chief
BAAQMD Engr.
CUSA 2013
5-13
Mr. Tom Johnston

Mr. Chris Magnus
Mr. Michael Banks
Mr. Steve Morioka
Mr. Maples
Mr. Bill Hammell
February 2013
SITE SAFETY PLAN

8/06/12 - #4 Crude Unit Fire
At or around 3:48 PM, an operator noticed a small hydrocarbon leak from insulated piping on the
C-1100 Atmospheric Distillation Column of the 4 Crude Unit. At some point shortly before 6:25
PM, the size of the release abruptly increased, and subsequently a fire ignited in the area of the
failure.
The failure involved an 8 carbon-steel atmospheric gas-oil pipe line from the atmospheric
distillation tower. The primary location of the fire was near P-1149 (C-1100 Atmospheric
Column No. 4 Sidecut pump). The fire emissions are products of the hydrocarbon combustion:
Sulfur Dioxide (2000 pounds) and Nitric Oxides (32 pounds).
At 6:38 PM, a Community Warning System Level 3 alert was initiated by the Refinery and the
CWS alarm sounded. At or around this timeframe, both Petro-Chem Mutual Aid and Municipal
Mutual Aid, such as County Hazardous Materials and Richmond Fire, were called in for support.
Also at or around this timeframe, a shelter-in-place order was issued for Richmond, San Pablo,
and North Richmond. The shelter-in-place order, affecting approximately 55,000 people, advised
residents to remain indoors until the fire was controlled. At 11:12 PM, the shelter-in-place order
was lifted by CCHMP.
The root cause(s) and contributing factors have not yet been finalized as CUSAs investigation
into this incident is on-going. Recommendations from the investigation are being developed and
will be addressed after completion of the investigation.
According to the Contra Costa Health Services website, approximately 14,000 people sought
medical attention at local emergency rooms (three individuals were admitted to the hospital).
Most reported cases have been minor complaints of nose, throat or eye irritation or respiratory
issues. Offsite property damage is estimated at $12,500.
Six employees received first aid onsite by the Refinery Fire Department and/or the onsite clinic.
All employees returned to work on the same shift. There were no injuries to contractor personnel
associated with this incident. Onsite property damage is estimated at $5,300,000.
Weather conditions were as follows:
WindSpeed
WindDirection
Precipitation
Temperature(F)
CUSA 2013
11.5MPH
134(SE)
None
75
5-14
February 2013
SITE SAFETY PLAN

7.0
Appendices
Simplified Process Flow Diagrams for Covered Processes
CUSA 2013
Covered processes
#4 Crude Unit
#5 NHT
#5 Rheniformer
Penhex-Isom
DHT
5 H2S
FCC
Alky
Alky/GRU
SHU
Butamer
Yard DIB
LPG Storage
Railcar Storage
Poly
3 H2S/SWC
SRU
NH3 Storage
TKC
TKN/ISO
SDA
#8 Plant
LNC
HNC
LNF
GRU
#18 Plant
Cogen
T&B Crude
JHT
GHT
H2 Manufacturing
Hydro Flares
HNF
Gas Distribution
7-1
February 2013
Generator
Exhaust Gas
Air
Duct
Burners
Combustion
Turbine
Steam
Heat
Recovery
Steam
Generator
S
C
R
Diesel Fuel
850# Steam
LPG
Natural Gas
Refinery Fuel Gas
Ammonia
Boiler Feed Water
THIS
IS
AN
AUTOCAD
DRAWING.
DO
NOT
REVISE
MANUALLY.
SCALE
NONE
ENGR.
OPR'G
DEPT.
DR.
DOGR
ENGR.
DEPT.
SIMPLIFIED
BWBB
10/04/2011
REV
DR.APP.TPVA DATE 08-01-03 APPROVED
RMP
FLOW
COVERED
DIAGRAM
PROCESS
COGENERATION
PLANT
UTILITIES AND ENVIRONMENTAL AREA BUSINESS UNIT

W.O.
S.O.
A-344591-0

Chevron Richmond Refinery Site-Safety-Plan

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chevron Richmond Refinery Site-Safety-Plan

Uploaded by

Copyright:

Available Formats

RICHMOND REFINERY

SITE SAFETY PLAN

SITE SAFETY PLAN

SITE SAFETY PLAN

LAST REVISION: 8/14/2003 6:22:35 AM

SITE SAFETY PLAN

LAST REVISION: 8/14/2003 6:22:35 AM

Do it safely or not at all; and

SITE SAFETY PLAN

Determination of Covered Processes within the Refinery

SITE SAFETY PLAN

Flammables, H2S, NH3

Flammables, H2S, NH3

Flammables, H2S, NH3

Flammables, H2S, NH3

1 H2SO4 is regulated by Cal/ARP because it is mixed with flammable hydrocarbons.

SITE SAFETY PLAN

Maximum Quantity in Process (pounds)

Characteristics and Hazards Associated with the Regulated Substances

Characteristics and Hazards of Anhydrous Ammonia

SITE SAFETY PLAN

The concentration below which it is believed that nearly all individuals

The concentration below which it is believed that nearly all individuals

NH3 is difficult to ignite and is not flammable under normally

Chemical-Specific Prevention Steps for Anhydrous Ammonia

Each storage vessel is equipped with a firewater deluge system to reduce

The NH3 storage area is encircled by a firewater-monitor fog system. One

SITE SAFETY PLAN

Characteristics and Hazards of Hydrogen Sulfide

SITE SAFETY PLAN

The concentration below which it is believed that nearly all individuals

The concentration below which it is believed that nearly all individuals

Vapor specific gravity

Emergency Response Planning Guideline

Chemical-Specific Prevention Steps for Hydrogen Sulfide

Each SRU train is equipped with either a safety shutdown system or a

Each H2S Recovery Plant can be routed to an emergency scrubber in the

SITE SAFETY PLAN

Each process that contains significant quantities of H2S is equipped with

Characteristics and Hazards of Regulated Flammable Hydrocarbons

SITE SAFETY PLAN

TLV (8-hr exposure)

Parts Per Million

Chemical-Specific Prevention Steps for Flammable Hydrocarbons

A distance sufficient to limit a fire to a single sphere separates each

The surrounding area is equipped with a fire suppression system, which

Characteristics and Hazards of Sulfuric Acid

SITE SAFETY PLAN

= Emergency Response Planning Guideline

Chemical-Specific Prevention Steps for H2SO4

Process equipment that contains H2SO4 is equipped with alarms,

In case of emergency shutdown, H2SO4 containing process gasses are

SITE SAFETY PLAN

H2SO4 storage is equipped with containment berms so that potential

Process sewers are equipped with pH analyzers to detect possible loss of

Description of Processes within the Refinery

SITE SAFETY PLAN

Cracking Refinery Business Unit

SITE SAFETY PLAN

SITE SAFETY PLAN

SITE SAFETY PLAN

The RMP-regulated substances

SITE SAFETY PLAN

Distillation and Reforming Refinery Business Unit